CVE-2026-54838

Name of the Vulnerable Software and Affected Versions WC Vendors Marketplace versions prior to 2.6.9

Description The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with subscriber-level access or higher to perform SQL Injection. This allows the addition of malicious SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update to a version newer than 2.6.8.