WCFM – Frontend Manager for WooCommerce

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WCFM – Frontend Manager for WooCommerce

Information

Software Type Plugin
Software Slug wc-frontend-manager (view on wordpress.org)
Software Status Active
Software Author wclovers
Software Website wclovers.com
Software Downloads 1,734,478
Software Active Installs 20,000
Software Record Last Updated July 16, 2026

12 Vulnerabilities

Submit a Vulnerability
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
5.3
CVE-2026-12994
Jul 10, 2026
Researcher: Niv Kochan
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
4.3
CVE-2026-10041
Jul 10, 2026
Researchers: mrholmes, papadope
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
8.1
CVE-2026-2554
May 1, 2026
Researcher: Supakiad S. (m3ez)
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
8.1
CVE-2026-4896
Apr 3, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
7.2
CVE-2026-0845
Feb 9, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
WCFM – Frontend Manager for WooCommerce <= 6.7.24 - Missing Authorization
4.3
CVE-2025-54004
Dec 15, 2025
Researcher: benzdeus
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
6.5
CVE-2025-3780
Jul 8, 2025
Researcher: Brian Sans-Souci (liardom)
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
8.8
CVE-2024-8290
Sep 24, 2024
Researcher: wesley (wcraft)
WCFM – Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting
4.4
CVE-2024-29929
Mar 25, 2024
Researcher: Steven Julian
WCFM Frontend Manager <= 6.6.0 - Missing Authorization
6.3
CVE-2022-4937
Apr 5, 2023
Researcher: Chloe Chamberland
WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery
6.3
CVE-2022-4938
Apr 5, 2023
Researcher: Chloe Chamberland
WCFM - Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
8.8
CVE-2021-24835
Oct 11, 2021
Researcher: ZhongFu Su
Title Status CVE ID CVSS Researchers Date
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller Patched CVE-2026-12994 5.3 Niv Kochan July 10, 2026
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers Patched CVE-2026-10041 4.3 mrholmes, papadope July 10, 2026
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion Patched CVE-2026-2554 8.1 Supakiad S. (m3ez) May 1, 2026
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation Patched CVE-2026-4896 8.1 Osvaldo Noe Gonzalez Del Rio (Os) April 3, 2026
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update Patched CVE-2026-0845 7.2 Osvaldo Noe Gonzalez Del Rio (Os) February 9, 2026
WCFM – Frontend Manager for WooCommerce <= 6.7.24 - Missing Authorization Patched CVE-2025-54004 4.3 benzdeus December 15, 2025
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification Patched CVE-2025-3780 6.5 Brian Sans-Souci (liardom) July 8, 2025
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation Patched CVE-2024-8290 8.8 wesley (wcraft) September 24, 2024
WCFM – Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting Patched CVE-2024-29929 4.4 Steven Julian March 25, 2024
WCFM Frontend Manager <= 6.6.0 - Missing Authorization Patched CVE-2022-4937 6.3 Chloe Chamberland April 5, 2023
WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery Patched CVE-2022-4938 6.3 Chloe Chamberland April 5, 2023
WCFM - Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection Patched CVE-2021-24835 8.8 ZhongFu Su October 11, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation