CVE-2026-81286
CriticalCVSS 9.3Summary
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
Risk Assessment
The risk includes the possibility for an unauthenticated attacker to manipulate the database, potentially leading to data leakage or corruption.
Recommendation
It is recommended to upgrade WCFM Marketplace to a version newer than 3.8.1 and use parameterized queries.
Other vulnerabilities in WCFM Marketplace
See all- CVE-2026-83562Medium
Contributor Cross Site Scripting (XSS) vulnerability in WCFM Marketplace versions up to 3.8.2. A user with Contributor role can inject malicious script.
- CVE-2026-12126Medium
The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.7.3 due to insufficient input sanitization and output escaping of the 'post_title' field. Authenticated attackers with Vendor-level access or higher can inject arbitrary web scripts that execute when users access affected pages.
Original NVD description (English source)
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.