CVE-2021-24835: WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-08 · updated 2026-06-17
Weakness: CWE-89

Description

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks

Affected products

wclovers WCFM – Frontend Manager for WooCommerce: before 6.5.12 — fixed in 6.5.12

How to fix

Upgrade to a fixed version: wclovers WCFM – Frontend Manager for WooCommerce 6.5.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24835 or the next vulnerability affects your stack