CVE-2026-12994 is an authorization bypass vulnerability (CWE-862) in the WCFM – Frontend Manager for WooCommerce WordPress plugin affecting all versions up to 6.7.27. The issue is due to missing authorization checks in the wcfm-my-account-enquiry-manage controller branch, which does not verify if a user is logged in or has the required permissions. The nonce intended as a security measure is embedded in all public pages, making it accessible to unauthenticated attackers. This flaw enables attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in the wp_wcfm_enquiries database table, and cause unsolicited notification emails to be sent to customers and vendors. Unlike other controller branches, this branch lacks proper user capability checks, leading to the bypass.

The vulnerability allows unauthenticated attackers to modify store inquiries by injecting arbitrary reply content and overwriting inquiry records, which can disrupt store operations and customer communications. Additionally, attackers can trigger unsolicited notification emails to customers and vendors, potentially causing confusion or phishing risks. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Due to the lack of an official patch or temporary fix, consider restricting access to affected plugin features or disabling the plugin if feasible to prevent exploitation.