The WCFM – Frontend Manager for WooCommerce plugin omits a capability check in the WCFM_Settings_Controller::processing function, allowing any authenticated user with Shop Manager level or higher to modify plugin options. This flaw enables changing the default role for new registrations to administrator, giving attackers full control over the site.

All versions of the WCFM – Frontend Manager for WooCommerce plugin up to and including 6.7.24, released by WCLovers, are affected. The vulnerability resides in the settings controller and core AJAX handler files referenced in the plugin’s repository.

The CVSS score of 7.2 reflects a high severity vulnerability that permits privilege escalation by authenticated users. The EPSS score is less than 1%, indicating low current exploitation probability, and the issue is not in the CISA KEV catalog. Attackers must be authenticated with Shop Manager or higher; no remote code execution or unauthenticated access is required. Nonetheless, the ability to arbitrarily update options poses a significant risk to site security when registration settings and user roles are not tightly controlled.