CVE-2024-8290: 
WordPress vulnerability analysis and mitigation

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress contains an Insecure Direct Object Reference vulnerability (CVE-2024-8290) affecting all versions up to and including 6.7.12. The vulnerability exists in the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key (NVD).

The vulnerability stems from insufficient validation of the ID user controlled key in the WCFM_Customers_Manage_Controller::processing function. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD, Wordfence).

The vulnerability allows authenticated attackers with subscriber/customer-level access or above to change the email address of administrator user accounts. This capability enables attackers to reset the password and gain unauthorized access to administrator accounts (NVD).

The vulnerability requires an authenticated user with at least subscriber/customer-level privileges to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should update to a version newer than 6.7.12 which contains the security fix. The patch can be found in the WordPress plugin repository (WordPress Plugin).