CVE-2022-4937

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2629284%40wc-frontend-manager&new=2629284%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2630745%40wc-frontend-manager&new=2630745%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633187%40wc-frontend-manager&new=2633187%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634199%40wc-frontend-manager&new=2634199%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d946d4b5-bed7-4808-b133-783b2dcd7992?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2629284%40wc-frontend-manager&new=2629284%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2630745%40wc-frontend-manager&new=2630745%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633187%40wc-frontend-manager&new=2633187%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634199%40wc-frontend-manager&new=2634199%40wc-frontend-manager&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d946d4b5-bed7-4808-b133-783b2dcd7992?source=cvePatch, Third Party Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-49364In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49365In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49366In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49367In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49368In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2022-49369In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49370In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49371In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49372In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49373In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49374In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49375In the Linux kernel, the following vulnerability has been re…5.5