CVE-2026-62000
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WCFM Marketplace plugin (wc-multivendor-marketplace) by WC Lovers contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects WCFM Marketplace versions from n/a through 3.8.2.
Risk Assessment
Missing authorization may allow unauthorized users to access functions or data that should be protected, potentially compromising the security of the site.
Recommendation
Update the WCFM Marketplace plugin to a version later than 3.8.2 if available, or apply vendor guidance. Review permission configuration as well.
Other vulnerabilities in WCFM Marketplace
See all- CVE-2026-83562Medium
Contributor Cross Site Scripting (XSS) vulnerability in WCFM Marketplace versions up to 3.8.2. A user with Contributor role can inject malicious script.
- CVE-2026-81286Critical
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
- CVE-2026-12126Medium
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.7.3 due to insufficient input sanitization and output escaping of the 'post_title' field. Authenticated attackers with Vendor-level access or higher can inject arbitrary web scripts that execute when users access affected pages.
Original NVD description (English source)
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS