A high-severity SQL injection vulnerability in the WCFM Marketplace plugin allows authenticated attackers with administrative privileges to compromise database confidentiality.

The vulnerability is a classic SQL injection flaw (CWE-89) located within the wc-multivendor-marketplace plugin. Based on the CVSS vector (PR:H), this attack requires an authenticated user with administrative capabilities to trigger the malicious SQL command.

The ability to execute arbitrary SQL queries poses a significant risk to the integrity and confidentiality of the WordPress database. An attacker could potentially extract sensitive vendor, customer, or order information, leading to severe data breaches and regulatory non-compliance. With a CVSS score of 7.6, this vulnerability represents a high risk that warrants immediate attention to prevent unauthorized data exposure.

Immediate Action: Administrators should monitor the official WC Lovers repository for a security update and apply the patch as soon as it is released. If an update is not immediately available, consider temporarily deactivating the WCFM Marketplace plugin.

Proactive Monitoring: Review database error logs and audit trails for suspicious query patterns or unexpected database access attempts originating from administrative accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while awaiting a permanent fix.

Public Exploit Available: No.

Given the high CVSS score, it is imperative to treat this vulnerability with urgency once a patch becomes available. Security teams should prioritize the identification of all instances of the WCFM Marketplace plugin within their environment and prepare for an immediate update. Until a patch is deployed, restrict administrative access and monitor closely for any signs of database-related irregularities.