The WCFM – Frontend Manager for WooCommerce plugin contains a missing capability check on the wcfm_redirect_to_setup function. As a result, an attacker who does not have any authentication or authorization can view and alter the plugin's settings, including payment details and API keys. This breach allows modification of critical configuration data.

The vulnerability is present in the WCFM plugin from wclovers, specifically the Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible version 6.7.16 and earlier. No other versions are known to be affected, and no detailed version range beyond 6.7.16 is provided.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that active exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is a remote web request to the plugin's setup endpoint, which does not require user authentication, as inferred from the description. An attacker can exploit this to view or change the plugin settings, including payment configurations and API keys.