WooCommerce Plugin Allows Vendor-Level Users to Delete Any Account

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WCFM – Frontend Manager for WooCommerce plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its user deletion function. By failing to validate the 'customerid' parameter in the 'wcfm_delete_wcfm_customer' action, the plugin allows authenticated users with Vendor-level privileges or higher to delete arbitrary accounts—including administrator accounts. This affects all versions up to 6.7.25 and represents a critical account takeover and privilege escalation risk for WooCommerce sites that rely on this widely-used vendor management plugin. The vulnerability is particularly dangerous because it requires only basic authentication, making it accessible to any vendor account on the platform.

Casky's 261 matching skills use Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns such as: direct object reference attempts in wp-admin API calls, unexpected user deletion events from vendor-level accounts, manipulation of object identifiers in WCFM requests, and lateral movement attempts following vendor account compromise. The platform's skill mapping would surface detection rules for monitoring unauthorized account modifications, analyzing parameter validation failures in plugin callbacks, and correlating vendor account activity with administrative user deletions—enabling security teams to catch exploitation attempts before critical accounts are compromised.

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-2554.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-2554 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn