EUVD-2025-17284
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3Tags
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace allows Blind SQL Injection. This issue affects WC Vendors Marketplace: from n/a through 2.5.6.
Analysis
Blind SQL injection vulnerability in WC Vendors Marketplace plugin versions through 2.5.6 that allows authenticated attackers with high privileges (administrator or vendor) to extract sensitive database information without direct output visibility. The vulnerability has a CVSS score of 7.6 with high confidentiality impact, though integrity is not compromised and availability impact is low. No publicly available exploit code or active exploitation has been confirmed at this time, but the attack requires only network access and high privilege authentication.
Technical Context
This vulnerability exists in the WC Vendors Marketplace WordPress plugin (vendor: 'WCVendors'), a multi-vendor marketplace solution built as a WooCommerce extension. The root cause is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, indicating unsanitized or unparameterized user input being directly concatenated into SQL queries. The blind SQL injection variant is particularly concerning because the attacker cannot see query results directly in application responses; instead, they must infer database structure and content through time-based or boolean-based inference techniques. The vulnerability likely exists in marketplace query functions, user data retrieval, or vendor-specific database operations where input validation was insufficient or parameterized queries were not implemented.
Affected Products
WC Vendors Marketplace (through 2.5.6)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today