PT-2026-57414 · WordPress · Wcfm – Frontend Manager For Woocommerce

Niv Kochan · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-12994

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WCFM – Frontend Manager for WooCommerce versions prior to 6.7.28

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Specifically, the wcfm-my-account-enquiry-manage branch lacks is user logged in() or current user can() checks, relying solely on a nonce that is embedded in public page loads. This allows unauthenticated attackers to inject arbitrary reply content into store inquiries, overwrite the main inquiry record in wp wcfm enquiries, and trigger unsolicited notification emails to customers and vendors.

Recommendations Update WCFM – Frontend Manager for WooCommerce to version 6.7.28 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12994

Affected Products

Wcfm – Frontend Manager For Woocommerce

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-12994 · Security Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-manager · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/controllers/enquiry/wcfm-controller-enquiry-manage.php#L290 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L321 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L48 · Note
• https://twitter.com/CVEnew/status/2075869774668566981 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/controllers/enquiry/wcfm-controller-enquiry-manage.php#L290 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/controllers/enquiry/wcfm-controller-enquiry-manage.php#L278 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-frontend.php#L1197 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L48 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/676b4637-a2c7-4a95-b644-bb0401f91b40?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-frontend.php#L1197 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/controllers/enquiry/wcfm-controller-enquiry-manage.php#L278 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L321 · Note