CVE-2026-14196

The WCFM Marketplace WordPress plugin (versions before 3.8.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a marketplace vendor owns a specific review before processing requests to unapprove or delete it. This allows any authorized vendor to mod...