WCFM Marketplace EUVD-2026-119008

Exploitation requires an authenticated account with at least low privileges on the target site (CVSS PR:L) - in a WCFM Marketplace deployment this is typically a registered vendor or customer account rather than an anonymous visitor. No user interaction is needed (UI:N) and the flaw is network-reachable with low attack complexity (AV:N/AC:L). Limiting factors: the authentication prerequisite blocks purely anonymous attackers, scope is unchanged (S:U), and impact is confined to limited integrity modification (I:L) with no confidentiality or availability effect. The specific feature, endpoint, or configuration that lacks the authorization check is not described in the available sources.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:L/A:N, base 4.3, Medium) indicates a network-reachable, low-complexity flaw that nonetheless REQUIRES an authenticated account (PR:L) and yields only limited integrity impact with no confidentiality or availability loss. The vuln.today decision label is 'this_month', consistent with a bounded, authenticated broken-access-control bug rather than an act_now/emergency item. Not listed in CISA KEV, so there is no confirmed active exploitation. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The only reference is a Patchstack database advisory page, which is a vendor catalog entry, not verified working exploit code. Net: a real, patch-worthy authenticated access-control defect of medium severity; prioritize within normal monthly patching, not as an incident.

An attacker who already holds a low-privileged account on the WooCommerce/WCFM Marketplace site (e.g., a registered vendor or customer) sends an authenticated request to a plugin endpoint that fails to verify the caller's authorization, letting them perform or alter an action reserved for higher-privileged users. Because the CVSS vector is AV:N/AC:L with only low integrity impact, the action is remotely reachable and easy to trigger but limited to partial, unauthorized data modification. No public exploit was identified at time of analysis; the only reference is a Patchstack advisory, not verified exploit code.