{
 "id": "WPSEC-2026-2373",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2373/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2373/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2373/index.md",
 "title": "WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Privilege Escalation via WooCommerce and WordPress REST API",
 "description": "The WCFM Marketplace plugin for WordPress is vulnerable to Privilege Escalation via the WooCommerce and WordPress REST APIs in all versions up to, and including, 3.8.3. This is because the vendor role carries store-wide capabilities, such as manage_woocommerce, list_users and edit_others_posts, for use in the WCFM dashboard, and nothing limits those capabilities on the REST API. This makes it possible for authenticated attackers with vendor or vendor staff access who are kept out of wp-admin to read every store's orders, customers and their personal data through the WooCommerce and WordPress REST APIs, change WooCommerce settings, payment gateways and webhooks, refund or annotate other stores' orders, and edit other users' posts and pages.",
 "plugin": {
  "slug": "wc-multivendor-marketplace",
  "name": "WCFM Marketplace",
  "full_name": "WCFM Marketplace – Multivendor Marketplace for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wc-multivendor-marketplace/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wc-multivendor-marketplace/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wc-multivendor-marketplace"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.4",
 "remediation": "Update to 3.8.4 or later.",
 "fix_released": "2026-11-02T08:53:05+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:56.325545+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2373/",
  "https://plugins.svn.wordpress.org/wc-multivendor-marketplace/tags/3.8.4/",
  "https://wordpress.org/plugins/wc-multivendor-marketplace/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wc-multivendor-marketplace",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}