Description
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2026-09-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Database compromise via unfiltered SQL injection
Action: Patch Immediately
AI Analysis

Impact

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is vulnerable to generic SQL injection through the wcfmmp_user_location_lng parameter. The plugin does not properly escape this user‑supplied value and fails to prepare the underlying SQL query, permitting attackers to inject arbitrary SQL code. When such a query executes, an unauthenticated user can read or modify sensitive information stored in the WordPress database, compromising confidentiality and integrity. This weakness is a classic input injection flaw identified as CWE‑89.

Affected Systems

All installations of the WCFM Marketplace plugin for WooCommerce released by Wclovers up through version 3.8.2 are susceptible. Any WordPress site that has this version of the plugin installed is at risk.

Risk and Exploitability

The CVSS v3.1 score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that, although opportunity exists, the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is an unauthenticated, remote HTTP request that includes a crafted wcfmmp_user_location_lng parameter; no user credentials or privileged access are required to trigger the injection.

Generated by OpenCVE AI on September 19, 2026 at 20:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WCFM Marketplace plugin to version 3.8.3 or later to remove the vulnerable code path
  • If an immediate upgrade is not possible, block or sanitize the wcfmmp_user_location_lng query parameter by validating that it contains only numeric latitude/longitude data or reject the request at the web‑server layer
  • After mitigation, limit the database user privileges required by the plugin to the minimum necessary and monitor database activity for suspicious queries

Generated by OpenCVE AI on September 19, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 19 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 19 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Wclovers
Wclovers wcfm Marketplace – Multivendor Marketplace For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Wclovers
Wclovers wcfm Marketplace – Multivendor Marketplace For Woocommerce
Wordpress
Wordpress wordpress

Fri, 18 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wclovers Wcfm Marketplace – Multivendor Marketplace For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-19T14:21:52.170Z

Reserved: 2026-07-30T20:46:52.840Z

Link: CVE-2026-18442

cve-icon Vulnrichment

Updated: 2026-09-19T14:14:19.567Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T08:17:00.443

Modified: 2026-09-19T15:16:58.940

Link: CVE-2026-18442

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T20:30:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')