CVE-2026-120849 · Package
NO FIX YET
WCFM Marketplace, a WooCommerce multivendor plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control levels. The affected range runs through version 3.8.3, and the impact is described only as access control weakness.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WCFM Marketplace WordPress plugin (wc-multivendor-marketplace) at version 3.8.3 or earlier. The sources do not state which roles or settings are needed to exploit it, so treat any site with vendor accounts or custom access levels as in scope.
Not affected if plugin-version-above-3.8.3
Who cares wcfm-marketplace, woocommerce, wordpress
wc-multivendor-marketplace plugin headerNo fix yet, per the sources.
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.