CVE-2026-2554 - Vulnerability Analysis

Overview

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress <= 6.7.25 contains an insecure direct object reference caused by missing validation on 'customerid' in 'wcfm_delete_wcfm_customer', letting authenticated attackers with Vendor-level access delete arbitrary users including Administrators, exploit requires Vendor-level or higher privileges.

Severity & Score

Impact

Authenticated attackers with Vendor-level access can delete arbitrary users including Administrators, leading to privilege abuse and potential denial of service.

Mitigation

Update to the latest version beyond 6.7.25.

References

• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386
• https://plugins.trac.wordpress.org/changeset/3483695/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner