CVE-2022-4938: 
WordPress vulnerability analysis and mitigation

The WCFM Frontend Manager plugin for WordPress (versions up to and including 6.6.0) was identified with a Cross-Site Request Forgery (CSRF) vulnerability, tracked as CVE-2022-4938. The vulnerability was discovered due to missing nonce checks on various AJAX actions, affecting hundreds of AJAX endpoints (NVD).

The vulnerability stems from missing nonce checks on various AJAX actions within the plugin. The CVSS v3.1 base score is rated as HIGH (8.8) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a severe security risk. An alternative assessment by Wordfence rated it as MEDIUM (6.3) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L (NVD).

The vulnerability allows unauthenticated attackers to perform a wide variety of unauthorized actions including modifying knowledge bases, notices, payments, managing vendors, and capabilities. The attack can be executed if an attacker can trick a site's administrator into performing an action such as clicking on a malicious link (NVD).

The vulnerability has been patched. Users should update their WCFM Frontend Manager plugin to a version newer than 6.6.0 to mitigate this security risk (Wordfence).