Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1

Executive Summary

A critical unauthenticated SQL injection vulnerability, tracked as CVE-2026-81286, has been disclosed in WCFM Marketplace (WC Lovers' "Multivendor Marketplace for WooCommerce" plugin), affecting versions 3.8.1 and earlier. The flaw was published via the Patchstack vulnerability database and NVD on September 2, 2026, and carries a CVSS v3.1 score of 9.3 (Critical).

CVSS Score: 9.3 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

The vulnerability requires no authentication and no user interaction, is reachable over the network with low attack complexity, and can yield a high-confidentiality impact — meaning an attacker can extract arbitrary data from the site's database, including customer and vendor records stored by WCFM Marketplace and the underlying WooCommerce install.

Vulnerability Overview

Affected Versions

At time of writing, Patchstack and NVD have not published a confirmed patched release number. Site operators should monitor the WordPress.org plugin changelog for the next release and treat any version above 3.8.1 as the presumed fix until officially confirmed.

Why This Matters

WCFM Marketplace is a widely deployed multivendor extension for WooCommerce, used to run marketplace-style storefronts with multiple independent vendors on a single WordPress/WooCommerce install. An unauthenticated SQL injection in this context is especially severe because:

• No login is required — any anonymous visitor can attempt exploitation.
• Marketplace installs typically store vendor payout details, customer PII, and order data in the same database, all of which become exposed to a successful SQLi read.
• The "Scope: Changed" rating in the CVSS vector indicates the vulnerable component can affect resources beyond its own security scope, consistent with a database-level query injection that can pull data from unrelated tables (e.g., wp_users, wp_usermeta).

Recommended Actions

1. Check your installed version — wp plugin get wc-multivendor-marketplace --field=version via WP-CLI, or via Plugins > Installed Plugins in wp-admin.
2. Update immediately once a fixed release above 3.8.1 is published.
3. If no patch is yet available, consider temporarily deactivating WCFM Marketplace or placing a WAF rule in front of the site to block anomalous SQL-injection payloads (UNION SELECT, WAITFOR DELAY, stacked quotes) targeting plugin-specific endpoints.
4. Review database access logs for unusual query patterns or extraction attempts.
5. Rotate credentials for any administrator or vendor accounts if compromise is suspected.
6. Subscribe to Patchstack or Wordfence vulnerability feeds for this plugin to be notified the moment a fix ships.

References

• NVD — CVE-2026-81286
• OffSeq Threat Radar — CVE-2026-81286
• Patchstack — WCFM Marketplace Vulnerability Database

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active
• Authorizer Plugin Privilege Escalation