Unauthorized Data Modification in WCFM – Frontend Manager and WooCommerce Plugin by WordPress

CVE-2025-3780

What is CVE-2025-3780?

The WCFM – Frontend Manager for WooCommerce, alongside the Bookings Subscription Listings Compatible plugin, is susceptible to unauthorized data manipulation due to a lack of capability checks in the wcfm_redirect_to_setup function. This vulnerability affects all versions up to 6.7.16, allowing unauthenticated attackers to potentially access and alter critical plugin settings, such as payment information and API keys, thereby posing significant security risks.

References