Is CVE-2026-66625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66625 being exploited in the wild.

How severe is CVE-2026-66625?

High severity, with a CVSS score of 7.6, published 17 September 2026.

Which products and versions are affected?

Rymera Web Co WC Vendors Marketplace <=2.7.2.1.

Is there a fix for CVE-2026-66625?

A patch was published on 2026-09-17: Patch available in version 2.7.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66625 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-66625?

Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66625: WC Vendors Marketplace SQL injection in administrator

Q: Is there a fix for CVE-2026-66625?

A patch was published on 2026-09-17: Patch available in version 2.7.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66625 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-66625?

Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66625 · Severity: high · CVSS 7.6 · Published 2026-09-17

WC Vendors Marketplace is a WordPress plugin that allows vendors to manage their storefronts on WooCommerce sites. An SQL injection vulnerability in versions 2.7.2.1 and earlier allows authenticated administrators to read, modify, or delete database contents, including user accounts and sensitive customer data, potentially compromising the entire online store.

Vendors: Rymera Web Co.

Quick answers

Is CVE-2026-66625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66625 being exploited in the wild.
How severe is CVE-2026-66625?: High severity, with a CVSS score of 7.6, published 17 September 2026.
Which products and versions are affected?: Rymera Web Co WC Vendors Marketplace <=2.7.2.1.
Is there a fix for CVE-2026-66625?: A patch was published on 2026-09-17: Patch available in version 2.7.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66625 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-66625?: Check whether you run Rymera Web Co WC Vendors Marketplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection flaw in the WC Vendors Marketplace WordPress plugin affecting versions up to 2.7.2.1. It requires administrator-level privileges to exploit, meaning it is restricted to users with high-level site access. An attacker with admin rights can inject malicious SQL queries through the vulnerable code path to read, modify, or delete database records. The patch is available in version 2.7.2.2 and later.

Affected products

Rymera Web Co WC Vendors Marketplace <=2.7.2.1

Timeline

2026-09-08: disclosed: Reported to Patchstack
2026-09-17: advisory: Published by Patchstack and NVD
2026-09-17: patched: Patch available in version 2.7.2.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.