The vulnerability in the WooCommerce Frontend Manager allows authenticated users who possess Vendor-level or higher access privileges to perform arbitrary modifications on orders, posts, pages, and products through several AJAX actions, including wcfm_modify_order_status, delete_wcfm_article, delete_wcfm_product, and the article management controller. This weakness is a classic example of insecure direct object reference (CWE-639) where user-supplied identifiers are not properly validated, enabling the attacker to change data that they do not own. Consequences include tampering with order status, deleting or altering content, and potentially compromising business transactions and data integrity.

The affected vendor is wclovers and the product is the WooCommerce Frontend Manager (WCFM). All released versions up to and including 6.7.25 are vulnerable, with the issue present in the core plugin as well as in the integrated Bookings Subscription Listings plugin.

The vulnerability carries a CVSS score of 8.1, marking it as high severity. Exploitation requires authenticated access at the Vendor level or higher, which is typically granted to trusted users such as store managers. Given the simplicity of the AJAX interactions, successful exploitation is likely if an attacker can obtain such credentials. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no EPSS score is available, but the high CVSS indicates a significant risk when the conditions are met.