CVE-2026-12994 is an authorization bypass vulnerability (CWE-862) in the WCFM – Frontend Manager for WooCommerce WordPress plugin. The vulnerability affects all versions up to and including 6.7.27. The root cause is that the wcfm-my-account-enquiry-manage controller branch does not perform standard authorization checks such as is_user_logged_in() or current_user_can(). Instead, it relies solely on a nonce that is embedded in every public page load without requiring user login. This allows unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in the wp_wcfm_enquiries database table, and cause unsolicited notification emails to be sent to customers and vendors. Other related controller branches do perform proper authorization checks, making this a specific flaw in the wcfm-my-account-enquiry-manage branch.

An unauthenticated attacker can bypass authorization controls to modify store inquiries by injecting arbitrary reply content and overwriting inquiry records. This can lead to data integrity issues in the wp_wcfm_enquiries table and cause unsolicited notification emails to be sent to customers and vendors. The confidentiality of data is not impacted, but the integrity and reliability of inquiry data and communications are compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected functionality if possible. Monitor vendor channels for updates and apply patches promptly once released.