Extension WordPress
Vulnérabilités WCFM – Frontend Manager for WooCommerce
Cette page rassemble les failles publiées pour WCFM – Frontend Manager for WooCommerce, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WCFM – Frontend Manager for WooCommerce
12 fiches
WCFM – Frontend Manager for WooCommerce <= 6.7.27 – Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to…
*-6.7.27
6.7.28
10/07/2026
WCFM – Frontend Manager for WooCommerce <= 6.7.27 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This…
*-6.7.27
6.7.28
10/07/2026
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 – Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation…
*-6.7.25
6.7.26
01/05/2026
WCFM – WooCommerce Frontend Manager <= 6.7.25 – Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including `wcfm_modify_order_status`, `delete_wcfm_article`,…
*-6.7.25
6.7.26
03/04/2026
WCFM – WooCommerce Frontend Manager <= 6.7.24 – Authenticated (Shop Manager+) Arbitrary Options Update
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing'…
*-6.7.24
6.7.25
09/02/2026
WCFM – Frontend Manager for WooCommerce <= 6.7.24 – Missing Authorization
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.7.24. This makes it possible for authenticated attackers,…
*-6.7.24
6.7.25
15/12/2025
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 – Missing Authorization to Unauthenticated Plugin Settings Modification
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to,…
*-6.7.16
6.7.17
08/07/2025
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 – Insecure Direct Object Reference to Account Takeover/Privilege Escalation
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing…
*-6.7.12
6.7.13
24/09/2024
WCFM – Frontend Manager for WooCommerce <= 6.7.8 – Authenticated (Shop manager+) Stored Cross-Site Scripting
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.7.8 due to insufficient input sanitization…
*-6.7.8
6.7.9
25/03/2024
WCFM Frontend Manager <= 6.6.0 – Missing Authorization
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated…
6.6.0
6.6.1
05/04/2023
WCFM Frontend Manager <= 6.5.13 – Cross-Site Request Forgery
The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform…
*-6.5.13
6.6.0
05/04/2023
WCFM – Frontend Manager for WooCommerce <= 6.5.11 – Customer/Subscriber+ SQL Injection
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM – WooCommerce Multivendor plugin such as WCFM – WooCommerce Multivendor Marketplace, does not escape…
*-6.5.11
6.5.12
11/10/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.