WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Privilege Escalation via WooCommerce and WordPress REST API
- ID
- WPSEC-2026-2373
- Plugin
- WCFM Marketplace – Multivendor Marketplace for WooCommerce (wc-multivendor-marketplace)
- Affected
- all versions before 3.8.4
- Remediation
- Update to 3.8.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- WCFM Marketplace on WPSec AttackSurface
- Fix released
- Published
Description
The WCFM Marketplace plugin for WordPress is vulnerable to Privilege Escalation via the WooCommerce and WordPress REST APIs in all versions up to, and including, 3.8.3. This is because the vendor role carries store-wide capabilities, such as manage_woocommerce, list_users and edit_others_posts, for use in the WCFM dashboard, and nothing limits those capabilities on the REST API. This makes it possible for authenticated attackers with vendor or vendor staff access who are kept out of wp-admin to read every store's orders, customers and their personal data through the WooCommerce and WordPress REST APIs, change WooCommerce settings, payment gateways and webhooks, refund or annotate other stores' orders, and edit other users' posts and pages.
References
- https://wpsec.com/vuln/WPSEC-2026-2373/
- https://plugins.svn.wordpress.org/wc-multivendor-marketplace/tags/3.8.4/
- https://wordpress.org/plugins/wc-multivendor-marketplace/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS