Answer in brief
CVE-2026-10041 records a Medium severity (CVSS 4.3) vulnerability in WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers. The current sources do not mark it as known exploited. The current feed maps wclovers/WCFM – Frontend Manager for WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-10041 records a Medium severity (CVSS 4.3) vulnerability in WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers. The current sources do not mark it as known exploited. The current feed maps wclovers/WCFM – Frontend Manager for WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps wclovers/WCFM – Frontend Manager for WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| wclovers/WCFM – Frontend Manager for WooCommercegeneric | 0 | Not reported |
Published upstream
Jul 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 11, 2026
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.
Quoted source text, attributed separately from HOL analysis.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps wclovers/WCFM – Frontend Manager for WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| wclovers/WCFM – Frontend Manager for WooCommercegeneric | 0 | Not reported |
Published upstream
Jul 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 11, 2026
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.
Quoted source text, attributed separately from HOL analysis.