CVE-2026-66625

The WC Vendors Marketplace plugin in versions up to and including 2.7.2.1 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

An administrator or an attacker with a compromised administrator account could execute arbitrary SQL queries, risking data leakage, modification, or deletion from the WordPress database.

Update the WC Vendors Marketplace plugin to a version newer than 2.7.2.1 as soon as a fix is available, and apply the principle of least privilege to administrative accounts.