An authorization bypass vulnerability in the WCFM Frontend Manager for WooCommerce plugin allows authenticated users with vendor privileges to delete arbitrary users and administrators, posing a severe threat to platform integrity.

This is an Insecure Direct Object Reference vulnerability (CWE-639) occurring within the wcfm_delete_wcfm_customer function, triggered by missing validation on the user-controlled customerid key for authenticated attackers with Vendor-level access and above.

A successful exploitation of this vulnerability can lead to unauthorized deletion of core user accounts, including site administrators, resulting in catastrophic service disruption, potential complete loss of site control, and significant reputational damage. The associated CVSS score of 8.1 reflects a high severity level primarily driven by the high integrity and availability impact on the affected application.

Immediate Action: Update the WCFM Frontend Manager for WooCommerce plugin as soon as a patched version is made available by the vendor, or temporarily deactivate the plugin if no update is available.

Proactive Monitoring: Review web server and WordPress audit logs for suspicious user deletion requests originating from vendor accounts or unusual administrative changes.

Compensating Controls: Implement strict role-based access control audits to minimize the number of accounts possessing Vendor-level access or higher on the WooCommerce site.

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in the available data sources).

Given the high severity score of 8.1 and the potential for complete site takeover via administrator account deletion, organizations utilizing this plugin must audit user roles immediately. Administrators should apply the vendor patch as soon as it is released to mitigate the risk of privilege abuse and unauthorized data destruction.