Description

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-17T14:17:19.107Z",
  "pubdate": "2026-09-17T14:17:19.107Z",
  "executiveSummary": "The WC Vendors Marketplace plugin for WordPress, specifically versions 2.7.2.1 and below, contains an authenticated SQL injection vulnerability.\nThis vulnerability allows an attacker with administrator-level privileges to inject malicious SQL queries into the database through the plugin's administrative interface.\nBy manipulating input parameters that are not properly sanitized or parameterized, an attacker can execute arbitrary SQL commands, potentially leading to unauthorized data extraction, modification, or complete database compromise.\nThe risk implication is high, as successful exploitation results in full control over the application's data layer, compromising the confidentiality, integrity, and availability of the WordPress site.\nExploitation requires active administrator credentials and the ability to interact with the vulnerable administrative endpoints within the plugin.\nThis flaw highlights a critical failure in input validation and sanitization processes within the plugin's backend functionality.",
  "technicalDetails": "The vulnerability resides within the WC Vendors Marketplace administrative functionality, where user-supplied input is processed without adequate sanitization or the use of prepared statements.\nThe root cause is the unsafe concatenation of unsanitized input directly into SQL query strings executed by the database interface.\nAn authenticated attacker with administrator privileges can interact with specific administrative dashboard components to inject arbitrary SQL syntax.\nWhen a malicious payload is submitted through vulnerable input fields, it alters the structure of the intended SQL query, enabling the execution of injected commands alongside the legitimate query.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable administrative parameter within the WC Vendors Marketplace interface. Second, the attacker crafts a specifically tailored payload containing SQL syntax designed to manipulate the query (e.g., using UNION-based injection to extract data from tables). Third, the payload is submitted, reaching the backend handler where the unsafe query construction occurs. Finally, the database engine executes the modified query, returning the results of the attacker's injected command to the application response.\nThis vulnerability facilitates various post-exploitation activities, including blind or error-based data exfiltration, database schema discovery, and unauthorized modification of database records.\nBecause the vulnerability is triggered within the administrative context, it allows an administrator to compromise the database despite having legitimate access to the panel, potentially elevating privileges within the database management system or exfiltrating sensitive vendor and user data.\nThe vulnerability affects WC Vendors Marketplace version 2.7.2.1 and all preceding versions that share this insecure data handling implementation.\nThe exposure is confined to the administrative backend, requiring prior authentication and authorized access to the WC Vendors settings or dashboard features."
}