CVE-2026-0845

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0845", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-10T15:14:52.880Z", "datePublished": "2026-02-09T23:23:27.754Z", "dateUpdated": "2026-04-08T16:50:30.345Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:30.345Z"}, "affected": [{"vendor": "wclovers", "product": "WCFM \u2013 Frontend Manager for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.7.24", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}], "title": "WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4973cef3-dddf-4eb5-99f4-c23a0e162fd6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/controllers/settings/wcfm-controller-settings.php#L150"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455819/wc-frontend-manager/trunk/controllers/settings/wcfm-controller-settings.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-03T12:31:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-09T11:20:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:51:00.513226Z", "id": "CVE-2026-0845", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:51:38.298Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T16:51:00.513226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:51:34.477Z"}}], "cna": {"title": "WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wclovers", "product": "WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.7.24"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T12:31:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-09T11:20:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4973cef3-dddf-4eb5-99f4-c23a0e162fd6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/controllers/settings/wcfm-controller-settings.php#L150"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455819/wc-frontend-manager/trunk/controllers/settings/wcfm-controller-settings.php"}], "descriptions": [{"lang": "en", "value": "The WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-09T23:23:27.754Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0845", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:51:38.298Z", "dateReserved": "2026-01-10T15:14:52.880Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-09T23:23:27.754Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WCFM \u2013 Frontend Manager for WooCommerce", "vendor": "wclovers", "versions": [{"lessThanOrEqual": "6.7.24", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."}, {"lang": "es", "value": "El plugin WCFM \u2013 Frontend Manager para WooCommerce junto con Bookings Subscription Listings Compatible para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos que puede conducir a una escalada de privilegios debido a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n 'WCFM_Settings_Controller::processing' en todas las versiones hasta la 6.7.24, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel de Shop Manager o superior, actualicen opciones arbitrarias en el sitio de WordPress. Esto puede ser aprovechado para actualizar el rol predeterminado para el registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso de usuario administrativo a un sitio vulnerable."}], "id": "CVE-2026-0845", "lastModified": "2026-06-17T10:11:29.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0845", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:51:00.513226Z", "version": "2.0.3"}}]}, "published": "2026-02-10T00:16:05.993", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/controllers/settings/wcfm-controller-settings.php#L150"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-ajax.php#L285"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3455819/wc-frontend-manager/trunk/controllers/settings/wcfm-controller-settings.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4973cef3-dddf-4eb5-99f4-c23a0e162fd6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.7.24]"}}], "product": "frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible", "vendor": "wclovers"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:41:53.039037+00:00", "value": {"mitigation_remediation": ["Upgrade the WCFM \u2013 Frontend Manager plugin to the latest version (\u22656.7.25).", "If an immediate upgrade is not possible, temporarily revoke Shop Manager permissions or disable the plugin until the patch is applied.", "Audit user roles and capabilities, ensuring only users who truly need Shop Manager level have that role, and reset the default registration role to a non-admin setting."], "summary": {"action": "Update Plugin", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "All versions of the WCFM \u2013 Frontend Manager for WooCommerce plugin up to and including 6.7.24, released by WCLovers, are affected. The vulnerability resides in the settings controller and core AJAX handler files referenced in the plugin\u2019s repository.", "description_and_impact": "The WCFM \u2013 Frontend Manager for WooCommerce plugin omits a capability check in the WCFM_Settings_Controller::processing function, allowing any authenticated user with Shop Manager level or higher to modify plugin options. This flaw enables changing the default role for new registrations to administrator, giving attackers full control over the site.", "risk_and_exploitability": "The CVSS score of 7.2 reflects a high severity vulnerability that permits privilege escalation by authenticated users. The EPSS score is less than 1%, indicating low current exploitation probability, and the issue is not in the CISA KEV catalog. Attackers must be authenticated with Shop Manager or higher; no remote code execution or unauthenticated access is required. Nonetheless, the ability to arbitrarily update options poses a significant risk to site security when registration settings and user roles are not tightly controlled."}}}}, "created": "2026-02-10T21:42:13.499086+00:00", "updated": "2026-04-15T18:45:11.448372+00:00", "vendors": ["wclovers", "wclovers$PRODUCT$frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible", "wordpress", "wordpress$PRODUCT$wordpress"]}