WCFM WooCommerce Frontend Manager Privilege Escalation Vulnerability

A vulnerability in the WCFM - Frontend Manager for WooCommerce plugin, specifically in versions through 6.7.24, allows authenticated users with Shop Manager-level access or higher to bypass capability checks and modify arbitrary data. This unauthorized data manipulation can lead to privilege escalation by enabling attackers to change user roles to administrator and activate user registration, thereby gaining administrative access on the affected WordPress site.

Impact

Exploitation of this vulnerability could result in unauthorized users gaining administrative privileges on the WordPress site.

Reproduction

To reproduce this vulnerability, an authenticated user with Shop Manager access or higher can send a request to the 'WCFM_Settings_Controller::processing' function without the necessary capability checks. This can be done by including the 'wcfm_settings_form' data in the request, which can be parsed and processed by the vulnerable function. Once the request is processed, the user can update various options on the site, including changing the default role for new users to administrator.

Remediation

Users are advised to update the WCFM - Frontend Manager for WooCommerce plugin to version 6.7.25 or later.