CVE-2026-10041: WCFM WooCommerce Auth Bypass Vulnerability

CVE-2026-10041 Overview

CVE-2026-10041 is an Insecure Direct Object Reference (IDOR) vulnerability in the WCFM – Frontend Manager for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 6.7.27 and stems from missing validation on a user-controlled key in the wcfm_product_archive handler. Authenticated attackers with subscriber-level access or higher can archive arbitrary vendors' products, toggle featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated subscriber can manipulate data belonging to other WooCommerce vendors, disrupting marketplace operations and destroying vendor enquiries and messages.

Affected Products

WCFM – Frontend Manager for WooCommerce plugin for WordPress
All versions up to and including 6.7.27
WordPress installations running the plugin with subscriber-level or higher user registration enabled

Discovery Timeline

2026-07-11 - CVE-2026-10041 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-10041

Vulnerability Analysis

The WCFM – Frontend Manager for WooCommerce plugin exposes several AJAX endpoints that accept object identifiers directly from client requests. The wcfm_product_archive action and related handlers in class-wcfm-ajax.php, class-wcfm-enquiry.php, and class-wcfm-notification.php do not verify that the authenticated user owns the referenced object. As a result, a low-privileged user can supply the identifier of a product, order, enquiry, or bulk message belonging to another vendor and the plugin will process the action as if the requester were the legitimate owner.

The impact is limited to integrity of marketplace data. Attackers cannot read confidential information or take the site offline, but they can archive competitors' products, flip featured flags to manipulate storefront visibility, prematurely close orders, and permanently delete vendor communications.

Root Cause

The root cause is a missing ownership check on user-controlled identifiers passed to plugin AJAX handlers. The vulnerable code paths trust the object ID supplied in the request and act on the target record without confirming that the current user has permission to modify it, matching the classic IDOR pattern described in CWE-639.

Attack Vector

Exploitation requires an authenticated account at subscriber level or higher, which is trivial to obtain on marketplaces that allow open registration. The attacker sends crafted AJAX requests to the vulnerable WCFM endpoints, substituting the ID parameter with values belonging to targeted vendors. No user interaction from the victim is required, and the request completes over the network against the standard WordPress admin-ajax interface.

Refer to the Wordfence Vulnerability Intel entry and the WordPress Changeset Overview for the specific code locations and patch diff.

Detection Methods for CVE-2026-10041

Indicators of Compromise

POST requests to admin-ajax.php with action=wcfm_product_archive originating from subscriber accounts.
WooCommerce products, orders, or listings changing state (archived, featured, completed) without a corresponding vendor action in audit logs.
Deletion events on vendor enquiries and bulk messages that do not correlate with the owning vendor's session.
Unusual volumes of AJAX activity from newly registered low-privileged accounts.

Detection Strategies

Enable verbose logging on wp-admin/admin-ajax.php and alert on wcfm_product_archive and related WCFM actions invoked by non-vendor roles.
Correlate the WordPress user ID of the AJAX requester with the vendor ID of the affected object; mismatches indicate exploitation.
Baseline normal WCFM administrative activity per vendor and flag cross-vendor object modifications.

Monitoring Recommendations

Ingest WordPress and WooCommerce logs into a centralized SIEM for retention and cross-account correlation.
Monitor for spikes in product archive, order completion, and enquiry deletion events after any new subscriber signup.
Track plugin version inventory across managed WordPress sites to identify installations still running 6.7.27 or earlier.

How to Mitigate CVE-2026-10041

Immediate Actions Required

Upgrade the WCFM – Frontend Manager for WooCommerce plugin to a version newer than 6.7.27 as soon as the vendor publishes a fixed release.
Audit recent product archive, featured toggle, order completion, and enquiry or bulk message deletion events for unauthorized changes.
Review subscriber-level accounts created recently and disable any that appear suspicious.
Restore affected vendor data from backups where destructive actions have been confirmed.

Patch Information

The vulnerability is documented against versions up to and including 6.7.27. Review the WordPress Changeset Overview and the Wordfence Vulnerability Intel advisory for patched version guidance, and apply the vendor update through the WordPress plugin manager once available.

Workarounds

Disable open user registration on WordPress or restrict the subscriber role until the plugin is patched.
Deploy a web application firewall rule that blocks or challenges admin-ajax.php requests with action=wcfm_product_archive from users below vendor role.
Temporarily deactivate the WCFM – Frontend Manager plugin on sites where marketplace functionality is not business-critical.

bash

# Example WAF rule concept for ModSecurity to block subscribers from calling the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1010041,msg:'Block WCFM IDOR CVE-2026-10041'"
  SecRule ARGS:action "@streq wcfm_product_archive" \
    "chain"
    SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "@rx .+" \
      "t:none"