The WCFM – Frontend Manager for WooCommerce plugin suffers from an Insecure Direct Object Reference vulnerability (CWE-639) in the wcfm_product_archive functionality. This occurs because the plugin fails to properly validate a user-controlled key, allowing authenticated users with subscriber-level privileges or higher to perform unauthorized actions on resources owned by other vendors. These actions include archiving arbitrary vendors' products, toggling featured status on listings, marking WooCommerce orders as completed, and deleting enquiries and bulk messages. The vulnerability affects all versions up to and including 6.7.27. No official patch or remediation guidance is currently available from the vendor.

The vulnerability allows authenticated users with low-level privileges (subscriber and above) to bypass authorization controls and manipulate data belonging to other vendors. This includes modifying product visibility, order status, and deleting communications, which can disrupt vendor operations and data integrity. There is no indication of confidentiality impact, and availability impact is not reported. The CVSS score is 4.3 (medium severity), reflecting limited impact on confidentiality and availability but notable integrity concerns.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to product archiving, order completion, and message deletion. Avoid granting unnecessary privileges to low-level users. Follow vendor channels for updates on patches or official mitigations.