EUVD-2026-82748
GHSA-35gj-4m99-3jxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public storefront endpoint
-
DeliveryInject SQL via wcfmmp_user_location_lng param
-
ExploitAppend UNION/stacked query to existing statement
-
ExecutionDatabase returns injected result set
-
ImpactExfiltrate user hashes and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the WCFM Marketplace (Multivendor Marketplace for WooCommerce) plugin versions up to and including 3.8.2. The injection is reachable via the 'wcfmmp_user_location_lng' parameter used in the plugin's frontend location/distance-based shipping logic; exploitation requires that WooCommerce and the WCFM Marketplace plugin be installed and active, and realistic reachability may depend on the store using the geolocation/shipping-by-distance code path that consumes this parameter. No authentication, user interaction, or elevated privileges are required (PR:N/UI:N), which is the primary factor making this broadly exploitable. |
| Impact | This is a genuinely high-priority issue. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is fully consistent with the description: an unauthenticated, network-reachable, low-complexity SQL injection with high confidentiality impact and no integrity/availability impact (a data-extraction SQLi rather than a write/RCE primitive). All decision signals align rather than conflict: attack vector is network, no privileges and no user interaction are required, and the injection sits in a frontend location/shipping code path (wcfmmp-core-functions.php / class-wcfmmp-frontend.php / class-wcfmmp-shipping-by-distance.php) that an anonymous storefront visitor can reach. No EPSS score, CISA KEV entry, or public exploit code was supplied in the input, so there is currently no evidence of active exploitation or a weaponized POC - the elevated risk is driven by exploitability characteristics and product footprint, not by observed in-the-wild activity. Unauthenticated SQLi in a popular WordPress/WooCommerce plugin is a well-understood, highly automatable bug class historically favored by mass-scanning campaigns, so despite the absence of KEV/EPSS data it should be treated as a real patch priority rather than a high-CVSS-but-low-real-risk finding. |
| Exploit ScenarioDerived | An anonymous attacker sends a crafted HTTP request to the store's frontend, injecting SQL through the 'wcfmmp_user_location_lng' geolocation/distance-shipping parameter, which is concatenated into an existing query without sufficient escaping or preparation. Using UNION-based or stacked injection, they extract sensitive database contents such as WordPress user records and password hashes. No public exploit code is referenced in the input, but the bug class is trivially automatable given the unauthenticated, low-complexity network vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
RemediationAI
Vendor-released patched version beyond 3.8.2 is implied by the advisory's version ceiling but is not independently confirmed here; the most specific fix evidence available is a WordPress.org plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3672063%40wc-multivendor-marketplace&new=3672063%40wc-multivendor-marketplace), so treat this as an upstream fix available (commit/changeset) and update the WCFM Marketplace plugin to the newest release from WordPress.org as soon as one newer than 3.8.2 is offered, verifying the plugin's version on each affected site after upgrade. Because this is an unauthenticated frontend issue, the effective interim mitigations are configuration- and perimeter-based rather than access-control based: (1) if the store does not use distance/geolocation shipping, disable that shipping method in WCFM Marketplace's shipping settings, which removes the reachable code path that consumes 'wcfmmp_user_location_lng' - the trade-off is loss of distance-based shipping quotes for vendors/customers; (2) deploy a WAF rule blocking or sanitizing requests whose 'wcfmmp_user_location_lng' (and related location) parameters contain SQL metacharacters and keywords, accepting the risk of false positives on legitimate geolocation lookups and the fact that a WAF is a compensating control, not a fix; (3) if neither the plugin's marketplace nor its geolocation shipping is needed, deactivate and remove the plugin entirely, which fully eliminates exposure at the cost of losing multivendor functionality. Monitor the plugin's changelog and the Wordfence advisory URL for a confirmed fixed version before re-enabling any disabled feature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in a PHP WordPress plugin. The WCFM Marketplace plugin (vendor: wclovers) extends WooCommerce with multivendor marketplace functionality, including geolocation-aware, distance-based shipping. The 'wcfmmp_user_location_lng' request parameter carries a longitude value used by that shipping logic and is concatenated into an existing SQL query without parameterization - the advisory notes insufficient escaping of the user-supplied value and lack of sufficient preparation of the query, i.e. no use of WordPress' $wpdb->prepare() or equivalent escaping. The referenced source locations - helpers/wcfmmp-core-functions.php (around line 982), core/class-wcfmmp-frontend.php (line 363), core/class-wcfmmp-shipping.php (line 315), and includes/shipping-gateways/class-wcfmmp-shipping-by-distance.php (line 83) - appear consistently in both the 3.7.3 and 3.8.0 plugin tags, indicating the vulnerable code path has been present across multiple releases, which is why every version up to and including 3.8.2 is affected. Because the injected value is appended to an already-constructed query rather than replacing it, the practical impact is read-oriented (union/boolean/error-based extraction of database contents, such as user credentials and WooCommerce order data) rather than write or code execution on the database server, which aligns with the C:H/I:N/A:N scoring.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); data-extraction only per description gives C:H with I:N/A:N and no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WCFM Marketplace - Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
A high-severity SQL injection flaw in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin, affecting all versions through 3.8.2, lets an unauthenticated attacker read data straight out of a store's WordPress database. Any organization running this plugin on an internet-facing WooCommerce storefront should treat customer, order, and vendor records as potentially exposed, and leadership should care because no vendor-released patch has been independently confirmed while remediation depends on a workaround. No public exploit code had been identified at time of analysis, and practical reachability depends on the store actually using the plugin's location/distance-based shipping path.
No vendor-released patch identified at time of analysis. Interim mitigations: block or filter the 'wcfmmp_user_location_lng' parameter via WAF/virtual patching, disable the location/distance-based shipping code path or the plugin itself on internet-facing stores, run WordPress with a least-privilege database account, and monitor web and database logs for SQL injection activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB