310 matches found
WCFM Membership <= 2.10.0 - Broken Access Control
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...
WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections. id: CVE-2021-24849 info: name: WCFM...
PoC-CVE-2022-4939-
PoC-CVE-2022-4939 Злоумышленник отправляет специально сформированный запрос к AJAX-действию wpajaxnoprivwcfmajaxcontroller, чтобы изменить форму регистрации членства и установить роль регистрации на администратора. Затем плагин обрабатывает запрос и изменяет форму регистрации членства, позволяя...
GHSA-WCFM-JP7M-RFFH
creationtimestamp| type| source ---|---|--- 2026-09-24 13:30:46+00:00| seen| https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwbeh3cfyva2...
WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.8.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WCFM Marketplace versions = 3.8.2...
CVE-2026-18442
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-82748
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442
WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin) is vulnerable to unauthenticated SQL injection via the 'wcfmmp_user_location_lng' and 'wcfmmp_user_location_lat' parameters in all versions up to, and including, 3.8.2 . The root cause is insufficient escaping on user-s...
CVE-2026-18442 WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-32480
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
EUVD-2026-70969
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
CVE-2026-32480
CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...
WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by mySebbe in WordPress Plugin WCFM Membership versions = 2.11.11...
CVE-2026-32480: Missing Authorization
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
PT-2026-85436
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...