WC Vendors Marketplace CVE-2026-66625

Exploitation requires an authenticated WordPress administrator account (PR:H) on a site running WC Vendors Marketplace version 2.7.2.1 or earlier; the attacker reaches an admin-side marketplace parameter that is vulnerable to SQL injection. No user interaction is needed (UI:N) and it is reachable over the network (AV:N), but the administrator-level authentication gate is the dominant limiting factor - this is not exploitable by unauthenticated visitors, vendors, or ordinary customers. Because a WP administrator already has full database and code-execution capability through normal admin functionality, the practical exposure is largely limited to insider misuse or post-compromise use of a hijacked admin session.

This is a high-CVSS-but-modest-real-risk issue driven almost entirely by the privilege requirement. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, score 7.6) explicitly encodes PR:H, and the vulnerability title itself is 'Administrator SQL Injection' - meaning the attacker must already hold administrator (or equivalently high) privileges in the WordPress/WooCommerce instance before the flaw is reachable. An actor with WP administrator rights can already read and modify the entire database and execute PHP via plugins/themes, so the marginal capability this SQLi grants is limited; the primary added value is direct, app-logic-bypassing query access. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. The one internal tension worth flagging: the vendor sets S:C and C:H yet I:N and A:L, which is an unusual impact profile for SQL injection (injection typically permits both read and write) - this likely reflects a read-oriented injection sink, but the I:N/A:L split should be verified against the Patchstack advisory. Net: legitimate to patch, but not an emergency for internet-facing exposure because pre-existing admin access is the gate.

An authenticated administrator (or a lower-privileged actor who has already compromised an admin account, e.g. via a separate phishing or credential-reuse chain) submits crafted input to a vulnerable marketplace admin parameter that is concatenated into a SQL query. The injected query returns database contents outside the plugin's intended scope (customer, order, and vendor data). No public exploit code is identified in the supplied intelligence, and the network attack vector requires no user interaction once admin access is held.