A critical privilege escalation vulnerability in the WCFM – Frontend Manager for WooCommerce plugin allows authenticated attackers to compromise administrative site access.

This vulnerability arises from a missing authorization check (CWE-862) within the WCFM_Settings_Controller::processing function. It allows authenticated attackers with Shop Manager privileges or higher to modify arbitrary WordPress options, including registration roles, to gain administrative control.

The ability to modify site settings enables an attacker to grant themselves administrative permissions, leading to a total compromise of the WordPress environment. Given the CVSS score of 7.2, this vulnerability poses a high risk to business operations, potentially resulting in unauthorized data access, site defacement, or the deployment of malicious content to customers.

Immediate Action: There is no specific patch version listed in the provided data; users should immediately deactivate the WCFM – Frontend Manager plugin until a security update is released by the vendor.

Proactive Monitoring: Review WordPress user account logs for unexpected creation of administrative accounts or changes to user registration settings.

Compensating Controls: Implement a Web Application Firewall (WAF) to monitor for suspicious POST requests targeting the WCFM settings controller endpoint.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant security risk for WooCommerce environments. Administrators should prioritize the removal or restriction of the affected plugin immediately. Maintain close observation of administrative user lists and verify that no unauthorized accounts have been created while the plugin was active.