CVE-2026-4896 - Vulnerability Analysis

Overview

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress <= 6.7.25 contains an insecure direct object reference caused by missing validation on user-supplied object IDs in multiple AJAX actions, letting authenticated attackers with Vendor-level access modify or delete orders, posts, products, or pages regardless of ownership.

Severity & Score

Impact

Authenticated attackers with Vendor-level access can modify or delete any order, post, product, or page, leading to data tampering and loss of integrity.

Mitigation

Update to the latest version beyond 6.7.25.

References

• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php?marks=644,880#L644
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-article.php?marks=271#L271
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f8248098-dff2-4bac-a138-aa40c7ab7a1c?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner