CVE-2025-3780: WCFM WooCommerce Auth Bypass Vulnerability

CVE-2025-3780 Overview

CVE-2025-3780 affects the WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress. The vulnerability exists in all versions up to and including 6.7.16. The wcfm_redirect_to_setup function lacks a capability check, allowing unauthenticated attackers to view and modify plugin settings. Exposed data includes payment configuration details and API keys used by the plugin. This flaw is categorized under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can access and modify plugin configuration, including payment details and API keys, on any WordPress site running a vulnerable WCFM Frontend Manager installation.

Affected Products

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin, versions * through 6.7.16
WordPress sites using the WCFM multivendor marketplace stack
WooCommerce stores integrated with WCFM Bookings, Subscriptions, and Listings modules

Discovery Timeline

2025-07-09 - CVE-2025-3780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3780

Vulnerability Analysis

The vulnerability resides in the wcfm_redirect_to_setup function declared in core/class-wcfm-admin.php of the WCFM Frontend Manager plugin. The function is hooked into a WordPress action that runs during standard request handling without verifying the requester's capabilities. Because no current_user_can() check or nonce validation occurs, any HTTP request that triggers the hook can invoke the underlying settings logic. Attackers therefore reach an administrative code path without authentication.

Once the code path is reached, the plugin exposes and accepts updates to configuration parameters including payment gateway settings and third-party API keys. Modification of these values enables attackers to redirect merchant payouts, exfiltrate API credentials, or alter marketplace behavior. Read access alone leaks sensitive integration secrets that can be reused against downstream services.

Root Cause

The root cause is a missing authorization check on a privileged action handler. The wcfm_redirect_to_setup function does not enforce a capability requirement such as manage_options and does not validate a WordPress nonce before executing sensitive logic. This aligns with [CWE-862] Missing Authorization.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker issues crafted HTTP requests to the vulnerable WordPress endpoint that dispatches the wcfm_redirect_to_setup hook. The server processes the request as if it originated from an authorized administrator. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the affected code paths.

Detection Methods for CVE-2025-3780

Indicators of Compromise

Unexpected changes to WCFM plugin settings, particularly payment gateway configuration and stored API keys
Web server access logs showing unauthenticated requests that trigger WCFM admin actions or the setup redirect flow
New or altered administrator-like activity on the site with no matching entry in the WordPress user session logs

Detection Strategies

Compare current plugin configuration values against a known-good baseline of WCFM payment and API settings
Alert on HTTP requests to WordPress endpoints that invoke WCFM hooks without an authenticated session cookie
Review WordPress options table entries associated with WCFM for unauthorized modifications

Monitoring Recommendations

Enable and centralize WordPress and web server access logs for anomaly review
Monitor outbound traffic for use of exfiltrated API keys against third-party services such as payment processors
Track the installed version of the WCFM Frontend Manager plugin across all WordPress instances to identify unpatched hosts

How to Mitigate CVE-2025-3780

Immediate Actions Required

Update the WCFM – Frontend Manager for WooCommerce plugin to a version later than 6.7.16 as soon as the vendor publishes a fixed release
Rotate all API keys, payment gateway credentials, and third-party integration secrets stored in the plugin configuration
Audit WCFM settings for unauthorized changes and restore verified values from backups where required

Patch Information

The vulnerability affects all versions up to and including 6.7.16. Site operators should apply the vendor-supplied patched release once available and confirm the fix in the plugin changelog. Reference the WordPress Plugin Source Code to verify that the wcfm_redirect_to_setup handler enforces a capability check in the deployed version.

Workarounds

Restrict access to the WordPress site with a web application firewall rule that blocks unauthenticated requests targeting WCFM admin actions
Temporarily disable the WCFM – Frontend Manager plugin on production sites until a patched version is installed
Limit administrative endpoints to trusted IP ranges at the reverse proxy or hosting layer

bash

# Example WAF rule concept: block unauthenticated requests that trigger the WCFM setup redirect
# Adjust to your WAF syntax and validate before enforcing in production
SecRule REQUEST_URI "@contains wcfm" \
  "id:1003780,phase:1,deny,status:403,\
   chain,msg:'Block unauthenticated WCFM admin action - CVE-2025-3780'"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"