WCFM Marketplace CVE-2026-81286

Exploitation requires only that the WCFM Marketplace plugin (<= 3.8.1) is installed and network-reachable on a WordPress site; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and no special non-default configuration are indicated. The practical limiting factor is that the vulnerable request parameter/endpoint is not named in the advisory, so an attacker must identify the specific injectable input; sites not running WCFM Marketplace, or already upgraded past 3.8.1, are not exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes low-effort, remote, unauthenticated exploitation, which is the highest-urgency profile for an internet-facing WordPress plugin; the 9.3 base score is driven by C:H (database disclosure) plus scope change, with I:N and only A:L. Unauthenticated WordPress plugin SQLi cataloged by Patchstack is a class that is frequently weaponized and mass-scanned once details or a POC surface, so exposure should be treated as time-sensitive even though there is currently no public exploit and no CISA KEV listing. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The main uncertainty is the affected parameter/endpoint, which the description does not name; defenders should assume any reachable WCFM request could be the vector and prioritize patching accordingly.

An attacker scanning for WordPress sites running WCFM Marketplace sends a crafted HTTP request with a malicious SQL payload to a vulnerable plugin parameter, without needing an account. The injected query extracts administrator password hashes and customer/order records from the shared database, enabling credential cracking or direct data theft. No public POC is identified yet, but the low-complexity unauthenticated vector makes reliable exploitation straightforward once the endpoint is known.