CVE-2025-12130
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. Missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint allows an unauthenticated attacker to delete vendor products via a forged request if they trick a site administrator into clicking a link.
Risk Assessment
An attacker can delete vendor products, causing financial losses and disruption to the marketplace.
Recommendation
Update the WC Vendors plugin to a version newer than 2.6.4 or disable it if no fix is available.
Other vulnerabilities in WC Vendors
See all- CVE-2026-81428Medium
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
- CVE-2026-81427Medium
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
- CVE-2026-81426Medium
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
- CVE-2026-15351Medium
The WC Vendors plugin for WordPress up to version 2.7.0 is vulnerable to generic SQL Injection via the 'status' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with shop manager-level access and above to append additional SQL queries, potentially extracting sensitive information from the database.
Original NVD description (English source)
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS