The WCFM – Frontend Manager for WooCommerce plugin, including its Bookings Subscription Listings Compatible extension, suffers from an authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This occurs because the 'wcfm_delete_wcfm_customer' endpoint fails to properly validate the 'customerid' parameter controlled by the user. As a result, authenticated attackers with Vendor-level privileges or higher can delete arbitrary user accounts, including those of administrators, potentially disrupting site operations and user management. The vulnerability is present in all versions up to 6.7.25. The CVSS 3.1 score of 8.1 indicates a high severity due to network attack vector, low attack complexity, required privileges, and significant impact on integrity and availability. No patch or official fix has been disclosed by the vendor as of the publication date.

Exploitation allows authenticated users with Vendor-level access or above to delete arbitrary user accounts, including administrators. This can lead to loss of administrative control, disruption of site management, and potential denial of service for affected users. The vulnerability does not impact confidentiality but has a high impact on integrity and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Vendor-level access to trusted users only and monitor for suspicious activity related to user deletions. Avoid granting Vendor-level privileges broadly. Review and harden access controls where possible.