Description

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T06:17:32.740Z",
  "pubdate": "2026-08-19T06:17:32.740Z",
  "executiveSummary": "The WCFM Marketplace WordPress plugin before 3.8.1 suffers from an access control vulnerability that allows unauthorized modification and deletion of store reviews.\nSpecifically, the application fails to verify whether a marketplace vendor making a request actually owns the target review prior to executing unapproval or deletion actions.\nThis flaw enables any authenticated malicious vendor to manipulate feedback data across the platform, impacting store reputations, tampering with customer trust, and compromising the integrity of the multi-vendor marketplace ecosystem.\nExploitation requires authenticated access as a vendor role within the marketplace, bypassing logical authorization boundaries without necessitating specialized privileges beyond standard vendor registration.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check within the review management functionality of the WCFM Marketplace plugin.\nWhen a vendor submits a request to unapprove or delete a review, the backend application processes the request based on supplied parameters without properly validating ownership against the currently authenticated user session.\nBecause the server-side logic omits checks to confirm whether the targeted review identifier corresponds to a product or store owned by the requesting vendor, an insecure direct object reference or missing function-level access control condition occurs.\nAn attacker authenticated with standard vendor privileges can craft an HTTP request specifying arbitrary review identifiers belonging to other vendors' stores.\nUpon receiving the request, the vulnerable component processes the action, resulting in the unauthorized unapproval or permanent deletion of the specified reviews.\nThe affected component is present in WCFM Marketplace versions prior to 3.8.1, exposing multi-vendor platforms to integrity violations where low-privileged users can disrupt operations and tamper with peer data."
}