The vulnerability CVE-2024-8290 in the WCFM – Frontend Manager for WooCommerce plugin arises from improper validation of a user-controlled key (ID) in the WCFM_Customers_Manage_Controller::processing function. This insecure direct object reference (CWE-639) allows authenticated users with low privileges to modify the email address of administrator accounts. By changing the admin email, attackers can trigger password reset mechanisms to gain unauthorized administrator access. The issue affects all plugin versions up to and including 6.7.12. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the user level, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with subscriber or customer-level privileges to escalate their access to administrator level by changing the administrator's email address and resetting the password. This leads to full compromise of the administrator account, resulting in complete control over the affected WordPress site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and privileges to trusted users only and monitor for suspicious account changes. Avoid granting subscriber or customer-level access to untrusted users. Follow updates from the vendor wclovers for patch availability.