CVE-2024-8290: WCFM WordPress Auth Bypass Vulnerability

CVE-2024-8290 Overview

CVE-2024-8290 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress. The flaw affects all versions up to and including 6.7.12. The WCFM_Customers_Manage_Controller::processing function fails to validate a user-controlled ID key. Authenticated attackers holding subscriber or customer-level access can modify the email address associated with an administrator account. Once the email is changed, the attacker triggers a password reset and gains full administrator control of the WordPress site.

Critical Impact
Low-privileged authenticated users can take over administrator accounts, leading to full WordPress site compromise.

Affected Products

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress
All versions up to and including 6.7.12
Vendor: wclovers

Discovery Timeline

2024-09-25 - CVE-2024-8290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8290

Vulnerability Analysis

The vulnerability resides in the customer management controller, specifically the WCFM_Customers_Manage_Controller::processing function. The controller processes requests to update customer profile data, including the email address bound to a user account. Because the function trusts a client-supplied ID parameter without verifying that the requesting user owns or is authorized to modify the referenced account, an attacker can substitute any target user ID, including that of an administrator.

After overwriting the administrator's email address with an attacker-controlled address, the attacker invokes the standard WordPress password reset workflow. The reset link is delivered to the attacker's mailbox, granting persistent administrator access to the site.

Root Cause

The root cause is missing authorization on a user-controlled object identifier. The processing function accepts an ID key from the request and performs privileged updates without confirming that the caller has permission to act on that record. This is a textbook Insecure Direct Object Reference (IDOR) pattern classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

The attack is executed over the network by an authenticated user with subscriber or customer-level privileges — a role that is often self-registerable on WooCommerce storefronts. The attacker submits a crafted request to the WCFM customer management endpoint, supplying the administrator's user ID and a new email address. No user interaction from the administrator is required. See the WordPress plugin source at line 97 and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-8290

Indicators of Compromise

Unexpected changes to the user_email field for administrator accounts in the wp_users table.
WordPress password reset emails sent to unfamiliar addresses shortly after a customer or subscriber login.
New administrator sessions originating from IP addresses previously associated with low-privilege accounts.
WCFM customer management requests referencing user IDs that do not belong to the requesting account.

Detection Strategies

Review web server access logs for POST requests to WCFM customer management endpoints where the id parameter does not match the session user.
Monitor the WordPress users table for out-of-band email address modifications on privileged accounts.
Alert on password reset events targeting administrator accounts that follow closely after activity from subscriber-level users.

Monitoring Recommendations

Enable an audit logging plugin to record profile changes, role assignments, and password resets.
Forward WordPress and web server logs to a centralized log platform for correlation.
Flag any HTTP transaction where a low-privilege session modifies data belonging to an administrator user ID.

How to Mitigate CVE-2024-8290

Immediate Actions Required

Update the WCFM – Frontend Manager plugin to a version later than 6.7.12 that includes the vendor patch.
Audit all administrator accounts for unauthorized email address changes and reset credentials where tampering is suspected.
Review recently created or elevated user accounts and remove any that are not legitimate.
Restrict customer and subscriber self-registration on sites that do not require it.

Patch Information

The vendor addressed the missing authorization check in the customer management controller. The fix is documented in the WordPress plugin changeset 3156433, which modifies wcfm-controller-customers-manage.php to validate that the requesting user is authorized to operate on the supplied ID.

Workarounds

Temporarily deactivate the WCFM – Frontend Manager plugin until the update can be applied.
Deploy a web application firewall rule to block requests to WCFM customer management endpoints where the id parameter does not match the authenticated session user.
Enforce two-factor authentication on all administrator accounts so that a hijacked password reset cannot complete the login.

bash

# Update the WCFM plugin using WP-CLI
wp plugin update wc-frontend-manager

# Verify installed version is greater than 6.7.12
wp plugin get wc-frontend-manager --field=version