External risk intelligence

Unauthenticated SQL Injection in WCFM Marketplace versions prior to 3.8.1

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81286

The vulnerability affects a marketplace plugin for web platforms. Such plugins are typically deployed as part of public-facing web applications, where they handle user interactions and data processing directly from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in a widely used marketplace plugin. The flaw allows unauthenticated attackers to inject malicious SQL code, potentially leading to unauthorized access or manipulation of sensitive data. The main concern is confirming whether this plugin is in use and verifying any potential exposure.

A flaw allows unauthorized data access.
It impacts a common marketplace plugin.
Confirm relevance and any exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to the affected marketplace plugin. This exposure allows for the injection of malicious SQL commands, potentially leading to unauthorized access or modification of sensitive data.

No authentication needed.
Triggered via network requests.
Risk of data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into the WCFM Marketplace plugin. When supported by the advisory's conditions, this could potentially lead to unauthorized access or manipulation of the marketplace's database, affecting stored product information or user data.

Marketplace database integrity.
Unauthenticated SQL injection.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in WCFM Marketplace impacts systems that process external user input, likely affecting application owners and platform teams responsible for the web application. The first critical step is to identify all instances of the affected marketplace plugin, assess their exposure to external access, and confirm their business criticality to prioritize remediation efforts with the accountable team.

Application owners should own the issue.
Verify plugin presence and external reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WCFM Marketplace plugin?

WCFM Marketplace is a software extension for WordPress that transforms a standard website into a multi-vendor e-commerce platform. It enables store owners to manage complex marketplace functions, such as vendor registration, commission tracking, and product catalogs, by adding specialized database management features to the underlying web platform.

What does SQL injection mean for CVE-2026-81286?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the plugin fails to properly filter user-provided input before using it in database queries. This allows an attacker to insert their own SQL commands, which the database then executes, potentially revealing sensitive information or bypassing security controls.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted web requests to the plugin without needing a login or account. The vulnerability specifically targets how the plugin processes inputs from these network requests. It is not triggered by standard site navigation or interactions that do not involve the specific, vulnerable input paths used by the marketplace plugin's data processing functions.

Is my site at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as a high priority because marketplace plugins are almost always deployed on public-facing web applications. Since the plugin is designed to process incoming user traffic directly from the internet to manage vendors and products, any site using an affected version is likely reachable by attackers.

Do I need to update my software to fix this?

You should begin by auditing your environment to locate all active installations of the WCFM Marketplace plugin. Once you confirm the plugin's presence and its accessibility to the internet, you must prioritize applying the available security updates. Coordinate with your team to verify the plugin version and patch it to move beyond version 3.8.1, which resolves the flaw.

References

patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.