Unauthorized Data Modification in WCFM Frontend Manager Plugin for WordPress
CVE-2022-4937

6.3MEDIUM

Key Information:

Vendor: Wordpress
Status: Wcfm – Frontend Manager For WooCommerce Along With Bookings Subscription Listings Compatible
Vendor: CVE Published:; 5 April 2023

What is CVE-2022-4937?

The WCFM Frontend Manager plugin for WordPress exhibits a significant vulnerability due to insufficient capability checks on multiple AJAX actions. This issue permits authenticated users with lower-level permissions, such as subscribers, to access sensitive functionalities like modifying knowledge bases, notices, payments, and vendor management. The vulnerability impacts numerous AJAX endpoints, exposing a wide array of critical controls to potential misuse.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible 6.6.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Apr 5, 2023
Vulnerability Reserved
Apr 5, 2023

Credit

Chloe Chamberland

JSON

Wordpress