CVE-2026-10041 is an authorization bypass vulnerability in the WCFM – Frontend Manager for WooCommerce WordPress plugin. The vulnerability arises from an insecure direct object reference (IDOR) due to missing validation on a user-controlled key parameter (wcfm_product_archive). Authenticated attackers with subscriber-level privileges or above can exploit this to perform unauthorized actions on resources owned by other vendors, including archiving products, changing featured statuses, completing orders, and deleting enquiries and bulk messages. The vulnerability affects all versions up to and including 6.7.27. No official patch or remediation level has been provided by the vendor as of the publication date.

The vulnerability allows unauthorized modification and deletion of data belonging to other vendors within the WooCommerce environment. Specifically, attackers can archive arbitrary vendor products, toggle featured statuses on listings, mark orders as completed, and delete enquiries and bulk messages. This can lead to data integrity issues and potential disruption of vendor operations. There is no indication of confidentiality or availability impact. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and the need for authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access and above to trusted users only. Monitor for suspicious activity related to product archiving, order status changes, and message deletions. Avoid granting unnecessary privileges to low-level authenticated users. Follow vendor communications for updates on patches or official mitigations.