WordPress Plugin Vulnerabilities

WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR

Description

The plugin does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

Proof of Concept

Affects Plugins

Plugin icon
wc-multivendor-marketplace
Fixed in 3.8.1

References

CVE
CVE-2026-14196

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Mustafa Ahmed
Submitter
Mustafa Ahmed
Submitter website
https://fortressmssp.com
Verified
Yes
WPVDB ID
877936f4-5664-4e17-b3cd-28f8f33f18ac

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2025-02-23
Title
Amelia < 1.2.17 - Unauthenticated Insecure Direct Object Reference
Published
2026-04-21
Title
Salon Booking System – Free Version < 10.30.25 - Unauthenticated Insecure Direct Object Reference
Published
2026-08-06
Title
Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
Published
2026-01-29
Title
Shiprocket <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-04-15
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.1 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation