WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in the WCFM – Frontend Manager for WooCommerce plugin for WordPress, affecting all versions up to and including 6.7.12. The flaw resides in the WCFM_Customers_Manage_Controller::processing function, which fails to validate a user-controlled ID parameter. This allows authenticated users with at least subscriber/customer-level access to modify the email address of any user account, including administrators [1].

Exploitation

An attacker must have an authenticated WordPress account with subscriber-level privileges or higher. By sending a crafted request that manipulates the ID parameter to target an administrator user, the attacker can change the administrator's email address. No additional privileges or user interaction are required [1].

Impact

Successful exploitation enables the attacker to change the email address of an administrator account. Because WordPress uses email addresses for password reset, the attacker can then request a password reset link to be sent to a controlled email address, gaining full access to the administrator account and potentially the entire WordPress site [1].

Mitigation

The plugin developer has released version 6.7.13 which fixes the IDOR vulnerability. Users should update to version 6.7.13 or later immediately. The vulnerable versions are all releases up to and including 6.7.12 [1].