CVE-2026-18442

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.2

Description The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the application fails to properly escape the wcfmmp user location lng parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by manipulating checkout coordinates to append additional queries, allowing the extraction of sensitive data, such as WordPress password hashes, from the database.

Recommendations Update the plugin to version 3.8.2 or later. As a temporary mitigation, restrict or disable the functionality that processes the wcfmmp user location lng parameter.