Cpe:2.3:a:wcfm:marketplace_multivendor_marketplace_for_woocommerce:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awcfmmarketplace_multivendor_marketplace_for_woocommerce/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 10:05:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in WCFM Marketplace Pluginhttps://feed.craftedsignal.io/briefs/2026-09-wcfm-sql-injection/Fri, 18 Sep 2026 10:05:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-wcfm-sql-injection/The WCFM Marketplace plugin for WordPress is vulnerable to unauthenticated SQL injection via the wcfmmp_user_location_lng parameter, allowing attackers to extract sensitive database information.The WCFM Marketplace - Multivendor Marketplace for WooCommerce plugin for WordPress is affected by a SQL injection vulnerability (CVE-2026-18442) in versions up to and including 3.8.2. The flaw exists due to improper input sanitization and insufficient preparation of SQL queries involving the 'wcfmmp_user_location_lng' parameter. Because the plugin does not correctly escape user-supplied data before passing it to the database, unauthenticated attackers can craft malicious inputs to manipulate backend queries. Successful exploitation allows for the execution of arbitrary SQL commands, which may lead to unauthorized access to sensitive site information, including user credentials, configuration details, and customer transaction records. Defenders should prioritize updating to the latest secure version of the plugin and monitoring web access logs for anomalous character sequences in parameters associated with location data.

Impact

The vulnerability poses a high risk to WordPress environments running the WCFM Marketplace plugin. If exploited, an unauthenticated attacker can perform unauthorized database queries, potentially leading to the full compromise of the database contents. This impacts the confidentiality and integrity of all store data, including personal identifiable information (PII) of vendors and customers, and could facilitate further stages of an attack chain such as account takeover or lateral movement within the WordPress environment.

Recommendation

  • Update the WCFM Marketplace - Multivendor Marketplace for WooCommerce plugin to the latest version that addresses CVE-2026-18442.
  • Deploy the provided Sigma rule to web server access logs to detect potential exploitation attempts.
  • Review web server access logs for HTTP requests containing SQL injection patterns such as comments (--), union statements, or common escape characters within the 'wcfmmp_user_location_lng' parameter.
]]>highadvisory