CVE-2026-4896 is an authorization bypass vulnerability (CWE-639) in the WCFM – Frontend Manager for WooCommerce and its Bookings Subscription Listings Compatible plugin for WordPress. The issue arises from insufficient validation of user-controlled object IDs in several AJAX endpoints such as `wcfm_modify_order_status`, `delete_wcfm_article`, and `delete_wcfm_product`. This flaw enables authenticated users with Vendor-level privileges or higher to perform unauthorized actions on orders, posts, products, and pages beyond their ownership scope. The vulnerability affects all versions up to and including 6.7.25.

The vulnerability allows attackers with Vendor-level access or above to modify the status of any order and delete or modify any post, product, or page regardless of ownership. This can lead to unauthorized data manipulation and potential disruption of e-commerce operations. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges at the vendor level, no user interaction, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Vendor-level access to trusted users only and monitor for suspicious activity related to order status changes and content modifications. Avoid granting elevated privileges unnecessarily. Follow vendor updates closely for any released patches or official mitigations.