CVE-2026-2554: 
WordPress vulnerability analysis and mitigation

CVE-2026-2554 is an Insecure Direct Object Reference (IDOR) vulnerability in the WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress. It affects all versions up to and including 6.7.25, allowing authenticated attackers with Vendor-level access or above to delete arbitrary WordPress users, including Administrators. The vulnerability was published on May 2, 2026, and a patch has been made available. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Wordfence).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639) in the wcfm_delete_wcfm_customer function within core/class-wcfm-customer.php (around line 386). The function accepts a customerid parameter supplied by the user without performing adequate authorization checks to verify whether the requesting user is permitted to delete the specified account. An authenticated attacker with at least Vendor-level privileges can supply an arbitrary user ID — including that of an Administrator — to the vulnerable function, triggering unauthorized account deletion (GitHub Advisory, WordPress Trac).

Successful exploitation allows an authenticated Vendor-level attacker to delete any WordPress user account, including site Administrators, resulting in high integrity and availability impact. Deletion of Administrator accounts can cause complete loss of administrative control over the WordPress site, service disruption, and potential site takeover if no other admin accounts remain. There is no confidentiality impact, as the vulnerability enables deletion rather than data disclosure (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.034% (0.000340), placing it in the 3rd percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Vendor level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Obtain Vendor-level access: Register or compromise a Vendor-level account on the target WordPress site running WCFM – Frontend Manager for WooCommerce version 6.7.25 or earlier.
2. Enumerate target user IDs: Use WordPress user enumeration techniques (e.g., querying the REST API at /wp-json/wp/v2/users or observing author archive URLs) to identify the numeric user IDs of Administrator accounts.
3. Craft a malicious request: Send an authenticated HTTP request to the WCFM AJAX endpoint invoking the wcfm_delete_wcfm_customer action, supplying the target Administrator's user ID as the customerid parameter (e.g., POST /wp-admin/admin-ajax.php with action=wcfm_delete_wcfm_customer&customerid=<admin_user_id>).
4. Achieve unauthorized deletion: Due to missing authorization validation, the server processes the request and deletes the specified Administrator account, stripping administrative access from the site (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with action=wcfm_delete_wcfm_customer and varying customerid values, particularly targeting high-privilege user IDs.
• Logs: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording unexpected user account deletions, especially of Administrator-role accounts.
• Application Behavior: Sudden disappearance of Administrator user accounts from the WordPress Users dashboard without corresponding legitimate administrative action.
• Network: Repeated or scripted AJAX requests from a single Vendor-level session targeting multiple customerid values in rapid succession.

Site administrators should immediately upgrade the WCFM – Frontend Manager for WooCommerce plugin to a version newer than 6.7.25, as a patch has been released (changeset 3483695) (WordPress Trac). As an interim measure, restrict Vendor-level access to only fully trusted personnel and audit existing Vendor accounts for any signs of misuse. Review WordPress user accounts for any unauthorized deletions and restore affected accounts from backups if necessary. Monitor server logs for suspicious wcfm_delete_wcfm_customer AJAX requests (Wordfence).

Wordfence published the vulnerability in their weekly WordPress vulnerability report covering April 27 – May 3, 2026, and included it in their threat intelligence database (Wordfence Blog). The CISA vulnerability bulletin for the week of April 27, 2026 also referenced this CVE (CISA Bulletin). Social media activity was limited, with brief mentions on Bluesky and Mastodon/Infosec.Exchange from automated CVE tracking accounts, indicating low community alarm consistent with the absence of active exploitation.