CVE-2026-12994 Overview
CVE-2026-12994 is an authorization bypass vulnerability in the WCFM – Frontend Manager for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 6.7.27. The wcfm-my-account-enquiry-manage controller branch fails to verify user authorization before processing enquiry actions. Unauthenticated attackers can inject arbitrary reply content into any store inquiry, overwrite records in the wp_wcfm_enquiries table, and trigger unsolicited notification emails to customers and vendors. The vulnerability is categorized under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated attackers can tamper with store inquiry records and abuse notification emails, damaging vendor-customer trust across affected WooCommerce marketplaces.
Affected Products
- WCFM – Frontend Manager for WooCommerce plugin for WordPress
- All versions up to and including 6.7.27
- WooCommerce multi-vendor marketplaces using the affected plugin
Discovery Timeline
- 2026-07-11 - CVE-2026-12994 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-12994
Vulnerability Analysis
The vulnerability resides in the enquiry management controller of the WCFM – Frontend Manager plugin. Sibling controller branches such as wcfm-enquiry and wcfm-enquiry-manage enforce authentication checks. The wcfm-my-account-enquiry-manage branch omits any is_user_logged_in() or current_user_can() verification. The only remaining barrier is a nonce token, but this nonce is embedded into every public page load without a login gate. An attacker can scrape the nonce from an unauthenticated request and use it to invoke privileged enquiry actions.
Successful exploitation permits arbitrary write access to any inquiry thread, regardless of ownership. The attacker can also weaponize the plugin's transactional email flow to send unsolicited messages to customers and vendors from the store's legitimate sender address.
Root Cause
The root cause is a missing authorization check [CWE-862] in the wcfm-my-account-enquiry-manage branch of the enquiry controller. The developer relied on WordPress nonces as the sole access control mechanism. Nonces are designed as CSRF (Cross-Site Request Forgery) tokens, not as authentication primitives. Because the nonce is rendered into every public page, it fails to bind requests to an authenticated user session.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker first fetches a public storefront page to harvest the WCFM nonce from the rendered HTML. The attacker then submits a crafted POST request to the WCFM AJAX endpoint targeting the wcfm-my-account-enquiry-manage action with an arbitrary enquiry_id and enquiry_reply payload. The controller processes the request without validating the caller's identity, updates the target record in wp_wcfm_enquiries, and dispatches notification emails. See the Wordfence Vulnerability Report and WCFM plugin source at class-wcfm-enquiry.php#L321 for the vulnerable code paths.
Detection Methods for CVE-2026-12994
Indicators of Compromise
- Unexpected entries or modifications in the wp_wcfm_enquiries database table, particularly in reply fields for inquiries the vendor did not respond to.
- Outbound notification emails from the WCFM plugin that do not correlate with authenticated vendor or admin activity in access logs.
- Customer complaints reporting inquiry replies or notifications they did not solicit.
Detection Strategies
- Inspect web server access logs for unauthenticated POST requests to admin-ajax.php or WCFM AJAX endpoints referencing the wcfm-my-account-enquiry-manage action.
- Correlate WCFM enquiry write events with authenticated session activity to identify writes originating from anonymous sources.
- Audit database change history on wp_wcfm_enquiries to identify replies posted without a corresponding logged-in vendor or customer session.
Monitoring Recommendations
- Enable WordPress activity logging that captures both authenticated and unauthenticated administrative AJAX calls.
- Monitor outbound mail queue volume for spikes in WCFM enquiry notification emails.
- Alert on repeated requests from a single IP address targeting WCFM enquiry endpoints without a valid authentication cookie.
How to Mitigate CVE-2026-12994
Immediate Actions Required
- Update the WCFM – Frontend Manager for WooCommerce plugin to a version later than 6.7.27 that contains the authorization fix.
- Review recent entries in wp_wcfm_enquiries for unauthorized replies and restore or remove tampered records.
- Notify affected customers and vendors if unsolicited notification emails were sent from the store.
Patch Information
Refer to the WordPress Plugin Change Set for the vendor's remediation commit. The fix must add is_user_logged_in() and current_user_can() checks to the wcfm-my-account-enquiry-manage controller branch, aligning it with sibling branches. Compare vulnerable source at wcfm-controller-enquiry-manage.php#L278 against the patched revision.
Workarounds
- If patching is not immediately possible, restrict access to WCFM AJAX endpoints at the web application firewall or reverse proxy layer to authenticated sessions only.
- Temporarily disable the WCFM – Frontend Manager plugin on production stores until the update is applied.
- Rate-limit anonymous POST requests to admin-ajax.php to reduce automated abuse of the vulnerable action.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
