The WCFM – Frontend Manager for WooCommerce plugin suffers from an authorization bypass vulnerability (CWE-639) due to insufficient validation of the 'customerid' parameter in the 'wcfm_delete_wcfm_customer' endpoint. Authenticated attackers with Vendor-level privileges or above can exploit this to delete arbitrary user accounts, including those with administrative privileges. This vulnerability affects all versions up to 6.7.25 and has a CVSS 3.1 base score of 8.1, indicating high severity. No patch or official remediation has been disclosed by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an authenticated user with Vendor-level access or higher to delete arbitrary user accounts, including administrators. This can lead to denial of service for affected users and potential loss of administrative control over the WordPress site. The vulnerability does not directly disclose data but impacts integrity and availability of user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Vendor-level access to trusted users only and monitor for suspicious activity related to user deletions. Avoid granting Vendor-level privileges broadly. No vendor advisory or patch links are currently provided.