CVE-2026-10041
Received Received - Intake

Insecure Direct Object Reference in WCFM Frontend Manager for WooCommerce

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-10041
EUVD
EUVD-2026-43162

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wcfm frontend_manager_for_woocommerce to 6.7.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the WCFM – Frontend Manager for WooCommerce plugin for WordPress is an Insecure Direct Object Reference (IDOR) issue present in all versions up to and including 6.7.27. It occurs via the wcfm_product_archive due to missing validation on a user-controlled key.

This flaw allows authenticated attackers with subscriber-level access or higher to manipulate data belonging to other vendors without proper authorization.

  • Archive arbitrary vendors' products
  • Toggle the featured status on arbitrary listings
  • Mark arbitrary WooCommerce orders as completed
  • Permanently delete arbitrary enquiries and bulk messages belonging to other vendors
Impact Analysis

This vulnerability can impact you by allowing attackers with low-level authenticated access to perform unauthorized actions on your WooCommerce store's data.

  • Attackers can archive products of other vendors, potentially disrupting their sales.
  • They can change the featured status of listings, affecting product visibility and marketing.
  • Attackers can mark orders as completed, which may cause confusion in order processing and fulfillment.
  • They can delete enquiries and bulk messages from other vendors, leading to loss of important communication.

Overall, this can lead to data integrity issues, loss of trust among vendors, and operational disruptions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart