Wc Lovers
Monthly
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the WooCommerce Frontend Manager - Ultimate WordPress plugin (versions prior to 6.7.7) allows authenticated subscriber-level users to inject SQL via plugin-handled input, exposing database contents and enabling limited data tampering on affected WooCommerce sites. The CVSS 8.5 rating reflects a scope change reaching the underlying database with high confidentiality impact. No public exploit identified at time of analysis.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the WooCommerce Frontend Manager - Ultimate WordPress plugin (versions prior to 6.7.7) allows authenticated subscriber-level users to inject SQL via plugin-handled input, exposing database contents and enabling limited data tampering on affected WooCommerce sites. The CVSS 8.5 rating reflects a scope change reaching the underlying database with high confidentiality impact. No public exploit identified at time of analysis.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrators or shop managers) to extract sensitive information from the site's database. Versions up to and including 3.7.1 are affected. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability of exploitation.