Unauthorized Data Modification in WCFM – Frontend Manager and WooCommerce Plugin by WordPress

CVE-2025-3780

What is CVE-2025-3780?

The WCFM – Frontend Manager for WooCommerce, alongside the Bookings Subscription Listings Compatible plugin, is susceptible to unauthorized data manipulation due to a lack of capability checks in the wcfm_redirect_to_setup function. This vulnerability affects all versions up to 6.7.16, allowing unauthenticated attackers to potentially access and alter critical plugin settings, such as payment information and API keys, thereby posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References