CVE-2026-0845: 
WordPress vulnerability analysis and mitigation

CVE-2026-0845 is a missing authorization vulnerability in the WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress that allows privilege escalation. The flaw affects all versions up to and including 6.7.24 and was published on February 10, 2026. It carries a CVSS v3.1 base score of 7.2 (High), requiring high privileges (Shop Manager level) to exploit over the network with no user interaction (Red Hat CVE, Wordfence).

The root cause is a missing capability check (CWE-862) on the WCFM_Settings_Controller::processing function, which fails to verify whether the calling user has sufficient permissions before processing settings changes. An authenticated attacker with Shop Manager-level access can send crafted requests to this function to update arbitrary WordPress site options without authorization. The most impactful exploitation path involves changing the default user registration role to 'administrator' and enabling open user registration, allowing the attacker to self-register a new administrator account (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated attacker with Shop Manager access to escalate privileges to full WordPress administrator, gaining complete control over the affected site. This includes the ability to install malicious plugins, modify content, exfiltrate sensitive data (user credentials, payment information stored via WooCommerce), and potentially pivot to the underlying server infrastructure. The integrity, confidentiality, and availability of the entire WordPress installation are fully compromised (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability has an EPSS score of approximately 0.015% (0.000150), indicating a currently low probability of exploitation in the wild. A Nuclei detection template pull request was submitted to the ProjectDiscovery repository, suggesting active interest from the security community in automated detection (Nuclei Templates PR). The vulnerability is detectable by Qualys (detection ID 530937) and has not been added to the CISA KEV catalog based on available information (Qualys).

1. Reconnaissance: Identify WordPress sites running the WCFM – Frontend Manager for WooCommerce plugin version ≤ 6.7.24 using tools like WPScan or by inspecting plugin metadata at /wp-content/plugins/wc-frontend-manager/readme.txt.
2. Obtain Shop Manager credentials: Acquire a valid Shop Manager (or higher) account through phishing, credential stuffing, or by registering if the site allows it.
3. Authenticate: Log in to the WordPress site with the Shop Manager account and obtain a valid authentication nonce/session cookie.
4. Send malicious settings request: Issue an authenticated POST request to the WCFM settings processing endpoint (targeting WCFM_Settings_Controller::processing) with parameters that set default_role to administrator and enable users_can_register.
5. Register administrator account: Navigate to the site's registration page and create a new user account, which will be assigned the administrator role due to the modified default role setting.
6. Achieve full site control: Log in with the newly created administrator account to gain complete control over the WordPress installation (Wordfence, Infinit Security).

• Logs: WordPress access logs showing authenticated POST requests to WCFM settings endpoints from Shop Manager accounts, particularly outside normal business hours; wp-login.php registration events creating new administrator-role accounts.
• Database: Changes to wp_options table entries for default_role (set to administrator) and users_can_register (set to 1) with unexpected timestamps.
• User Accounts: Newly created WordPress user accounts with administrator roles that were not provisioned by legitimate administrators; review wp_users and wp_usermeta tables for unexpected admin-role entries.
• Network: Unusual POST requests to WordPress admin-ajax or WCFM-specific endpoints from Shop Manager sessions, especially if originating from unfamiliar IP addresses.

Update the WCFM – Frontend Manager for WooCommerce plugin to version 6.7.25 or later, which introduces the missing capability check on the WCFM_Settings_Controller::processing function. As an interim workaround, restrict Shop Manager account creation and audit existing Shop Manager accounts for legitimacy. Additionally, verify that wp_options values for default_role and users_can_register have not been tampered with, and consider disabling open user registration if not required (Wordfence, Red Hat CVE).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as a privilege escalation risk for WooCommerce-based sites (Wordfence). RedPacket Security shared an alert about the CVE on Mastodon, contributing to community awareness (RedPacket Security). Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published early-warning advisories for the vulnerability (INCIBE-CERT).