WCFM Vulnerability Allows Attackers to Change Admin Email Addresses and Reset Passwords

CVE-2024-8290

Summary

The WCFM - Frontend Manager for WooCommerce, along with the Bookings Subscription Listings Compatible plugin for WordPress, is susceptible to an Insecure Direct Object Reference. This vulnerability arises from missing validation on the user-controlled ID key within the processing function of WCFM_Customers_Manage_Controller. Authenticated attackers with subscriber or customer-level access can exploit this flaw to modify the email addresses associated with administrator accounts, enabling them to reset passwords and potentially gain unauthorized access to those accounts.

References