The WCFM – Frontend Manager for WooCommerce plugin suffers from a missing capability check (CWE-862) in the wcfm_redirect_to_setup function, allowing unauthorized access to modify plugin configurations. This vulnerability affects all versions up to 6.7.16 and enables unauthenticated attackers to access and change sensitive data such as payment details and API keys. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed.

An attacker without authentication can view and modify critical plugin settings, including payment information and API keys, potentially leading to unauthorized transactions or compromise of integrated services. There is no indication of denial of service or system-level impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin management interfaces and consider disabling the affected plugin if possible. Monitor vendor communications for updates and apply patches promptly once available.