CVE-2026-81428
MediumCVSS 6.5Summary
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
Risk Assessment
Vendors can modify other vendors' products, potentially leading to data integrity issues, fraud, or disruption of the store.
Recommendation
Update the WC Vendors plugin to version 2.7.2.1 or later which includes the fix. Additionally, conduct a permissions audit and ensure ownership verification is enforced.
Other vulnerabilities in WC Vendors
See all- CVE-2026-81427Medium
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
- CVE-2026-81426Medium
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
- CVE-2026-15351Medium
The WC Vendors plugin for WordPress up to version 2.7.0 is vulnerable to generic SQL Injection via the 'status' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with shop manager-level access and above to append additional SQL queries, potentially extracting sensitive information from the database.
Original NVD description (English source)
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.