The vulnerability in WCFM – Frontend Manager for WooCommerce (up to version 6.7.24) arises from a missing capability check in the processing function of the WCFM_Settings_Controller class. Authenticated users with Shop Manager or higher privileges can exploit this flaw to update arbitrary WordPress options, including changing the default registration role to administrator and enabling user registration. This results in privilege escalation, allowing attackers to create administrative users on the affected site. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no patch or official vendor advisory available at this time, and no known exploits have been reported.

An attacker with Shop Manager-level access or higher can exploit this vulnerability to escalate privileges by modifying site options, including setting the default user role to administrator and enabling user registration. This can lead to unauthorized administrative access to the WordPress site, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only and monitor for suspicious changes to site options related to user roles and registration settings.