Descripción
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin WordPress is vulnerable to unauthorized modification of data due a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible unauthenticated attackers view modify settings, including payment details API keys
https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.16/core/class-wcfm-admin.php#L74
https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.16/core/class-wcfm-admin.php#L81
https://www.wordfence.com/threat-intel/vulnerabilities/id/26a82493-a6a5-4d8e-8322-942925a54cc3?source=cve
