CVE-2026-4896 is an authorization bypass vulnerability (CWE-639) affecting WCFM – Frontend Manager for WooCommerce and its related plugin for WordPress. The flaw arises from insufficient validation of user-controlled object IDs in several AJAX endpoints, including 'wcfm_modify_order_status', 'delete_wcfm_article', and 'delete_wcfm_product'. This allows authenticated attackers with Vendor-level privileges or above to perform unauthorized modifications to orders and content they do not own. The vulnerability affects all versions up to and including 6.7.25. No official patch or remediation guidance is currently available from the vendor.

The vulnerability enables authenticated users with Vendor-level access or higher to bypass authorization controls and modify order statuses or delete/alter posts, products, and pages without ownership verification. This can lead to unauthorized data manipulation and disruption of service availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Vendor-level access to trusted users only and monitor for suspicious activity related to order status changes and content deletions. Avoid granting unnecessary privileges to users to limit potential exploitation.