EUVD-2026-93038
GHSA-776h-74fg-9jjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WooCommerce multivendor store with vulnerable plugin
-
ExploitSend unauthenticated request to REST API endpoint
-
ExecutionBypass missing authorization check
-
ImpactRetrieve restricted marketplace/customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to be running the WooCommerce Multivendor Marketplace - REST API plugin (wc_lovers / WCFM) at version 1.6.3 or earlier, with the plugin's REST API endpoints reachable over the network (the default for an active installation). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - exploitation targets the plugin's default REST API behavior. The primary limiting factors are footprint-based rather than technical: the site must have this specific multivendor REST API add-on installed and unpatched, and impact is confined to confidentiality (information disclosure), with no direct integrity or availability effect. |
| Impact | This is a credible but moderate-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the 'Unauthenticated Broken Access Control' description and CWE-862 (Missing Authorization): a remote attacker needs no privileges, no user interaction, and low complexity to reach the vulnerable REST API endpoints. Impact is scoped to confidentiality only (C:H/I:N/A:N), indicating unauthorized data disclosure rather than data tampering or service disruption, which is why the base score lands at 7.5 (High) rather than Critical. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no SSVC decision data in the input, and the single Patchstack reference does not indicate public exploit code - so this is not currently a confirmed-exploited emergency. The signals do not conflict; rather, several enrichment signals (EPSS, KEV, SSVC, POC) are simply absent. Net: a real, remotely reachable unauthenticated data-exposure flaw worth prompt patching, but with no current evidence elevating it to active-exploitation priority. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests directly to the plugin's REST API endpoints on a WooCommerce multivendor store running version 1.6.3 or earlier, bypassing the missing authorization checks to retrieve data they should not be able to access (e.g., vendor, order, or customer information). No credentials, user interaction, or special timing are required. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.
RemediationAI
Upgrade the WooCommerce Multivendor Marketplace - REST API plugin to a version newer than 1.6.3 as soon as a patched release is available; check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wcfm-marketplace-rest-api/vulnerability/wordpress-woocommerce-multivendor-marketplace-rest-api-plugin-1-6-3-broken-access-control-vulnerability?_s_id=cve) for the exact fix version. No vendor-released patch identified at time of analysis. If an update is not immediately possible, consider temporarily disabling the plugin, though this will remove multivendor REST API functionality, or restrict access to its REST API endpoints via a Web Application Firewall (WAF) or server configuration to block unauthenticated requests. Note that WAF rules may require custom tuning to target the specific vulnerable endpoints without disrupting legitimate traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authorization (CWE-862) in the REST API component of the WooCommerce Multivendor Marketplace plugin (also known as WCFM Marketplace REST API). The plugin provides REST API endpoints for a multivendor marketplace built on WooCommerce and WordPress. Due to insufficient access control checks, unauthenticated users can access endpoints that should be restricted, leading to information disclosure. The CPE identifies the affected product as 'wc_lovers:woocommerce_multivendor_marketplace_-_rest_api' with all versions prior to and including 1.6.3 being vulnerable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation is network-based, requires no privileges or user interaction, and affects confidentiality only (C:H/I:N/A:N).
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated REST API authorization flaw reachable over the network (AV:N/PR:N/UI:N/AC:L); broken access control discloses restricted data, so C:H with I:N/A:N and scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace - REST API <= 1.6.3 versions.
Executive ViewAI
The WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) contains a high-severity missing authorization vulnerability (CVE-2026-39794) that could allow remote attackers to read sensitive data from affected WordPress sites. Organizations using this plugin risk exposure of confidential customer or vendor information, with no vendor patch currently available. This issue demands immediate attention to prevent potential data breaches and compliance violations.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the plugin if not essential, restricting REST API access via WAF or IP allowlisting, enabling detailed monitoring for unauthorized data access, and applying virtual patching if available through security vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB