CVE-2026-15351

Name of the Vulnerable Software and Affected Versions WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors versions prior to 2.7.1

Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This occurs because the status parameter is not sufficiently escaped and the SQL query is not properly prepared. The sanitize text field callback removes HTML but fails to strip SQL metacharacters. Additionally, slash protection is bypassed because WP REST Server::serve request() executes wp unslash() on GET parameters before the sanitization callback runs. This allows attackers to append malicious SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 2.7.0. Avoid using the status parameter in requests until the update is applied.