Executive brief
The WCFM Marketplace plugin for WordPress, used by thousands of multivendor e-commerce sites, contains a SQL injection vulnerability in user location data handling. Attackers can exploit this flaw without authentication to extract sensitive database information, including customer data and credentials, potentially compromising the entire marketplace and its users.
Technical details
The vulnerability is a generic SQL injection in the 'wcfmmp_user_location_lng' parameter affecting all versions up to 3.8.2. The root cause is insufficient escaping of user-supplied input and lack of prepared statements in the SQL query construction. The vulnerability is remotely exploitable without authentication via network access to the plugin's endpoint that processes the affected parameter. An attacker can inject arbitrary SQL to extract sensitive data from the WordPress database, including user credentials, customer information, and vendor details. No patch status is confirmed at the time of publication.
Affected products
- WCFM Marketplace up to and including 3.8.2
Timeline
- 2026-09-18: disclosed