Is CVE-2026-54838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54838 being exploited in the wild.

How severe is CVE-2026-54838?

High severity, with a CVSS score of 8.5, published 25 June 2026.

Which products and versions are affected?

Rymera Web Co WC Vendors Marketplace <= 2.6.8.

Is there a fix for CVE-2026-54838?

A patch was published on 2026-06-25: Version 2.6.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54838 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54838?

Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54838: Rymera Web Co WC Vendors Marketplace SQL injection

Q: Is there a fix for CVE-2026-54838?

A patch was published on 2026-06-25: Version 2.6.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54838 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54838?

Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54838 · Severity: high · CVSS 8.5 · Published 2026-06-25

WC Vendors Marketplace is a WordPress plugin that allows website owners to create a multi-vendor e-commerce platform similar to Etsy or eBay. A security flaw in this plugin allows logged-in users with basic 'Subscriber' accounts to execute unauthorized database commands. This could lead to the theft of sensitive customer data, exposure of site configuration details, or disruption of the marketplace's operations.

Vendors: Rymera Web Co.

Quick answers

Is CVE-2026-54838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54838 being exploited in the wild.
How severe is CVE-2026-54838?: High severity, with a CVSS score of 8.5, published 25 June 2026.
Which products and versions are affected?: Rymera Web Co WC Vendors Marketplace <= 2.6.8.
Is there a fix for CVE-2026-54838?: A patch was published on 2026-06-25: Version 2.6.9 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54838 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54838?: Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the WC Vendors Marketplace plugin for WordPress in versions up to and including 2.6.8. The flaw is caused by improper neutralization of user-supplied input in SQL commands (CWE-89). An attacker with a minimum of 'Subscriber' level privileges can exploit this via a network request to interact directly with the underlying database. Successful exploitation can lead to unauthorized data exfiltration or limited impact on database availability. The issue is resolved in version 2.6.9.

Affected products

Rymera Web Co WC Vendors Marketplace <= 2.6.8

Timeline

2026-05-08: other: Vulnerability reported by researcher hhhai
2026-06-18: advisory: Patchstack published advisory and mitigation rules
2026-06-25: disclosed: CVE published to NVD
2026-06-25: patched: Version 2.6.9 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.