A SQL injection flaw exists in the Subscriber interface of the WC Vendors Marketplace plugin for WordPress. The vulnerability allows an attacker to inject arbitrary SQL statements that are executed against the underlying database, potentially enabling the attacker to read, alter, or delete stored data. Such an attack could compromise the integrity and confidentiality of the site’s order and product information, and may provide a foothold for further exploitation if the plugin interacts with other components.

The flaw affects installations of the WC Vendors Marketplace plugin by Rymera Web Co running any version up to and including 2.6.8. Users of version 2.6.8 or earlier should review their installation and versioning. Updated releases, such as 2.6.9 and later, contain the vendor‑supplied fix.

The CVSS score for this issue is 8.5, indicating a high severity-level vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The nature of the flaw, as a SQL injection, suggests that an attacker who can access the subscriber endpoint may be able to exploit it; however, the specific attack vector and prerequisites are not detailed in the available data. The risk remains high due to the potential impact on data confidentiality and integrity.