Insecure Direct Object Reference in WCFM – Frontend Manager for WooCommerce

CVE-2026-2554

What is CVE-2026-2554?

The WCFM – Frontend Manager for WooCommerce, along with the Bookings Subscription Listings Compatible plugin for WordPress, allows authenticated users with Vendor-level access and higher to exploit an Insecure Direct Object Reference vulnerability. This issue arises from insufficient validation of the 'customerid' parameter in the 'wcfm_delete_wcfm_customer' function. Attackers can use this vulnerability to delete arbitrary user accounts, including those of Administrators, thereby compromising user management and potentially leading to significant data loss or system disruptions. It's critical for users to update to the latest version or implement additional security measures to mitigate this risk.

References