WCFM Frontend Manager for WooCommerce Insecure Direct Object Reference Vulnerability Allowing Arbitrary User Deletion

A vulnerability exists in the WCFM – Frontend Manager for WooCommerce plugin, specifically in versions through 6.7.25, including the Bookings Subscription Listings Compatible plugin. The issue is an Insecure Direct Object Reference (IDOR) that allows authenticated attackers with Vendor-level access or higher to delete any user, including Administrators. This vulnerability arises from a lack of proper validation on the 'customerid' key, which is controlled by the user.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of users, including those with Administrator privileges.

Remediation

Users are advised to update the WCFM Frontend Manager for WooCommerce plugin to version 6.7.26 or later.