53 matches found
CVE-2026-81427
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81426
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81428
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
CVE-2026-81427
CVE-2026-81427 affects the WC Vendors WordPress plugin (WooCommerce marketplace) in versions before 2.7.2.1 . The root cause is a missing ownership verification on the front-end order shipment status change endpoint: any authenticated vendor can target another vendor's order, mark it as shipped ,...
CVE-2026-81428
CVE-2026-81428 affects the WC Vendors WordPress plugin in versions prior to 2.7.2.1 . The root cause is a missing ownership and object-type verification on user-supplied IDs during product variation saves, resulting in an Insecure Direct Object Reference (IDOR) flaw. An authenticated user with th...
WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability
Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
EUVD-2026-69853
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
EUVD-2026-69854
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
EUVD-2026-69855
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability
Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81426
The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is missing CSRF protection on some front-end order shipment status actions. An attacker can craft a request that causes a logged-in vendor to unknowingly change the shipment status of their own orders, resulting in a low integrity impact ...
CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability
Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-15351
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-15351
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-15351 WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-59906
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-15351
CVE-2026-15351 affects the WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors WordPress plugin. The vulnerability is a generic SQL Injection via the status parameter in all versions up to and including 2.7.0, caused by insufficient escaping of the user-supplied value a...