CVE-2024-8290

🗓️ 25 Sep 2024 06:49:01Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 102 Views🌐 WEB

Vulnerability in WCFM – Frontend Manager for WooCommerce plugi

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2024-8290	25 Sep 202410:08	–	circl
CNNVD	WordPress plugin WCFM has a security vulnerability	25 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-8290 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation	25 Sep 202406:49	–	cvelist
EUVD	EUVD-2024-49071	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8290	25 Sep 202407:15	–	nvd
osv_cve	CVE-2024-8290	25 Sep 202407:15	–	osv_cve
Patchstack	WordPress WCFM – Frontend Manager for WooCommerce Plugin <= 6.7.12 is vulnerable to Privilege Escalation	25 Sep 202400:00	–	patchstack
Patchstack	WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation vulnerability	25 Sep 202401:31	–	patchstack
Positive Technologies	PT-2024-38918 · WordPress +1 · Bookings Subscription Listings Compatible +1	24 Sep 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-8290: Authorization Bypass Through User-Controlled Key	25 Sep 202400:00	–	rapid7

NVD

Vulners

Vulnrichment

Node

wclovers frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatibleRange<6.7.13wordpress

[
  {
    "vendor": "wclovers",
    "product": "WCFM – Frontend Manager for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.7.12",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3156433/wc-frontend-manager/trunk/controllers/customers/wcfm-controller-customers-manage.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/79172fe3-c0cf-48c4-8bc5-862c628c1a09
plugins	www.plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.12/controllers/customers/wcfm-controller-customers-manage.php

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	The WCFM_Customers_Manage_Controller::processing function fails to validate the user_id parameter, allowing authenticated users to change the email address of other accounts, including administrators.	CWE-639
user_id	request body	/wp-admin/admin-ajax.php	The WCFM_Customers_Manage_Controller::processing function fails to validate the user_id parameter, allowing authenticated users to change the email address of other accounts, including administrators.	CWE-639

17 Jun 2026 08:22Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.8

EPSS0.00603

SSVC

CWE-639