WCFM Vulnerability Allows Attackers to Change Admin Email Addresses and Reset Passwords

CVE-2024-8290

What is CVE-2024-8290?

The WCFM - Frontend Manager for WooCommerce, along with the Bookings Subscription Listings Compatible plugin for WordPress, is susceptible to an Insecure Direct Object Reference. This vulnerability arises from missing validation on the user-controlled ID key within the processing function of WCFM_Customers_Manage_Controller. Authenticated attackers with subscriber or customer-level access can exploit this flaw to modify the email addresses associated with administrator accounts, enabling them to reset passwords and potentially gain unauthorized access to those accounts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References