WCFM Marketplace EUVD-2026-116763

Prerequisite is a reachable WCFM Marketplace installation at version 3.8.2 or earlier (WooCommerce multivendor plugin for WordPress). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and unauthenticated with no user interaction required against affected versions. The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels' but does not name the exact endpoint, parameter, or feature that triggers it, so the precise action required is not described in the available sources. Limiting factors: impact is confined to integrity (no data disclosure or denial of service via this issue), and exposure depends on the plugin being installed and active on an internet-facing WordPress site.

Signals are moderate and partially incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, which maps to the 7.5 base score; however impact is scoped to integrity only (C:N/I:H/A:N), meaning an attacker can alter data but not read it or crash the service. No EPSS score was supplied, so statistical exploitation probability cannot be stated. KEV status is not listed (not in CISA KEV), and no PoC or exploit code is referenced - the only source is the Patchstack vulnerability database advisory. The vuln.today decision label is 'this_week', indicating prioritized-but-not-emergency remediation rather than act_now. On balance this is a credible, prioritize-this-week issue rather than a confirmed mass-exploitation event: the unauthenticated network vector makes it attractive, but the integrity-only impact and absence of KEV/EPSS/PoC signals argue against treating it as an active-exploitation emergency. Note the gap: the description names 'Incorrectly Configured Access Control Security Levels' but does not identify the specific endpoint or action, so the precise attack surface should be verified against the Patchstack advisory.

A remote, unauthenticated attacker sends a crafted request to a WCFM Marketplace plugin endpoint whose authorization check is missing or misconfigured, performing an action that should be restricted. Because the flaw affects integrity only (C:N/I:H), the attacker can modify marketplace data or settings they should not be able to change, but cannot directly read confidential data or take the site offline through this issue. No public exploit is referenced; the specific vulnerable action is not detailed in the available sources.