CVE detail
CVE-2026-12994
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 26.4 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 13
- within the 30d window
- Peak daily
- 12
- highest bucket
Evidence
Source links by recency
13 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026)Wordfence
.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API 5.3 CVSS Rating 5.3 (Medium) CVE-ID CVE-2026-13039 Patch Status Patched Published Jul 9, 2026 Affected Software Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] Researcher Niv Kochan More Details > Flatsome FundEngine – Do
vendorwww.wordfence.comJul 16, 2026, 8:29 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4637-a2c7-4a95-b644-bb0401f91b40?source=cvewww.wordfence.com
No excerpt available.
Third Party Advisorywww.wordfence.comJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-managerplugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-frontend.php#L1197plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L48plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L321plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/controllers/enquiry/wcfm-controller-enquiry-manage.php#L290plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/controllers/enquiry/wcfm-controller-enquiry-manage.php#L278plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-frontend.php#L1197plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L48plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L321plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/controllers/enquiry/wcfm-controller-enquiry-manage.php#L290plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/controllers/enquiry/wcfm-controller-enquiry-manage.php#L278plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 11, 2026, 7:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-47755CVSS 6.5 · Medium
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve p…
- CVE-2026-65916CVSS 7.2 · High
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, dele…
- CVE-2026-65895CVSS 8.2 · High
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege…
- CVE-2026-65537CVSS 4.3 · Medium
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
- CVE-2026-65531CVSS 4.8 · Medium
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
- CVE-2026-65530CVSS 4.3 · Medium
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.