EUVD-2025-209485
GHSA-m7v3-c773-h4rx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through 3.7.1.
AnalysisAI
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.
More in Wcfm Marketplace
View allMissing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund re
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attacker
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up t
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today