Description
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes.
Published: 2026-08-16
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a classic SQL Injection in the 'status' parameter of the WC Vendors REST API. Insufficient escaping of user supplied data allows an authenticated attacker with shop manager or higher permissions to inject additional SQL statements, which enables extraction of sensitive database contents such as user credentials, product details, or financial data. This weakness corresponds to CWE-89, an unsanitized input leading to SQL Injection.

Affected Systems

The vulnerability affects the WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, and Product Vendors plugin for WordPress in all releases up to and including version 2.7.0. Site administrators who have not updated to a newer release are at risk. No other WordPress plugins or core versions are impacted by this specific issue.

Risk and Exploitability

The CVSS base score of 4.9 indicates a moderate severity, and the EPSS score is not available while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an authenticated shop manager-level user can send a crafted GET request to the REST endpoint. Although no public exploit code exists, the moderate score and the ability to exfiltrate confidential data warrant timely remediation.

Generated by OpenCVE AI on August 16, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WC Vendors plugin to a version newer than 2.7.0, which removes the vulnerable 'status' parameter handling.
  • If an upgrade cannot be performed immediately, temporarily disable or limit the affected REST API endpoint for shop manager and higher role users until the plugin is updated.
  • Continuously monitor web application logs for signatures of SQL injection attempts and verify that no unauthorized data access occurs.

Generated by OpenCVE AI on August 16, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Wcvendors
Wcvendors woocommerce Multi-vendor, Woocommerce Marketplace, Product Vendors
Wordpress
Wordpress wordpress
Vendors & Products Wcvendors
Wcvendors woocommerce Multi-vendor, Woocommerce Marketplace, Product Vendors
Wordpress
Wordpress wordpress

Sun, 16 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes.
Title WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wcvendors Woocommerce Multi-vendor, Woocommerce Marketplace, Product Vendors
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-17T19:28:52.547Z

Reserved: 2026-07-09T21:26:22.401Z

Link: CVE-2026-15351

cve-icon Vulnrichment

Updated: 2026-08-17T19:27:53.539Z

cve-icon NVD

Status : Deferred

Published: 2026-08-16T06:16:50.620

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-15351

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T10:30:08Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')