WordPress WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification vulnerability

🗓️ 08 Jul 2025 20:54:59Reported by Brian Sans-Souci (liardom)Type

WCFM Frontend Manager plugin <= 6.7.16 has Broken Access Control vulnerability, fixed in 6.7.17.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-3780	9 Jul 202500:19	–	circl
CNNVD	WordPress plugin WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Security Vulnerability	8 Jul 202500:00	–	cnnvd
CVE	CVE-2025-3780	8 Jul 202523:22	–	cve
Cvelist	CVE-2025-3780 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification	8 Jul 202523:22	–	cvelist
EUVD	EUVD-2025-20756	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3780	9 Jul 202500:15	–	nvd
Positive Technologies	PT-2025-28802 · WordPress · Wcfm – Frontend Manager For Woocommerce +1	8 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-3780	11 Jul 202500:25	–	redhatcve
Vulnrichment	CVE-2025-3780 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification	8 Jul 202523:22	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (July 7, 2025 to July 13, 2025)	17 Jul 202515:42	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-frontend-manager/wcfm-frontend-manager-for-woocommerce-along-with-bookings-subscription-listings-compatible-6716-missing-authorization-to-unauthenticated-plugin-settings-modification

08 Jul 2025 20:54Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.5

EPSS0.00478

SSVC