Description

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-02T12:17:12.400Z",
  "pubdate": "2026-09-02T12:17:12.400Z",
  "executiveSummary": "The WCFM Marketplace plugin for WordPress, in versions 3.8.1 and earlier, is susceptible to an unauthenticated SQL injection vulnerability.\nThis vulnerability exists due to improper neutralization of user-supplied input before incorporating it into database queries.\nA remote, unauthenticated attacker can exploit this flaw to execute arbitrary SQL commands, potentially leading to unauthorized data exposure, modification, or deletion.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the underlying WordPress database.\nAttackers can leverage this vulnerability without requiring prior authentication or administrative privileges, significantly lowering the barrier for exploitation.\nSuccessful exploitation allows for the exfiltration of sensitive information, such as user credentials, customer data, or configuration details, depending on database permissions and schema structure.",
  "technicalDetails": "The vulnerability originates from the insecure handling of HTTP request parameters within the WCFM Marketplace codebase. Specifically, the application fails to sanitize or parameterize input provided by users before passing it to database query functions.\nIn versions 3.8.1 and earlier, certain endpoints or functional components fail to implement adequate input validation or prepared statements, allowing an attacker to inject malicious SQL syntax into queries executed by the WordPress database abstraction layer (wpdb).\nThe attack flow begins when an attacker sends a crafted HTTP request to the vulnerable endpoint, incorporating SQL injection payloads within parameters expected by the application. Because the application does not validate the structure or content of these parameters, the injected SQL commands are processed and executed by the backend database.\nThis allows the attacker to manipulate the original SQL query logic, such as using UNION-based injection to append results from other tables, or blind SQL injection techniques to infer data through boolean or time-based response analysis.\nThe vulnerable component essentially acts as a gateway, facilitating unauthenticated access to the database layer. Since the vulnerability does not require authentication, it is exposed over the network to any remote actor capable of reaching the WordPress installation.\nPost-exploitation impact is contingent upon the permissions of the database user configured for the WordPress site. In many environments, this can lead to full database compromise, including the retrieval of administrative credentials, which may further lead to complete site takeover, persistent backdoor installation, or arbitrary code execution if the database user has elevated privileges (such as FILE permissions).\nThe lack of prepared statements or proper escaping mechanisms throughout the identified component ensures that the input is treated as executable code rather than literal data. This design oversight fundamentally undermines the security posture of the WCFM Marketplace plugin, necessitating immediate remediation via input sanitization and the implementation of robust query parameterization techniques."
}