{"id":"CVE-2026-120849","kind":"vulnerability","aliases":["CVE-2026-120849"],"related":[],"title":"WCFM Marketplace: missing authorization lets users reach restricted access levels","description":"Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.","summary":"WCFM Marketplace, a WooCommerce multivendor plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control levels. The affected range runs through version 3.8.3, and the impact is described only as access control weakness.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wcfm-marketplace","woocommerce","wordpress"],"not_affected_if":["plugin-version-above-3.8.3"],"how_to_check":"- Check the installed WCFM Marketplace plugin version in the WordPress admin plugin list, or in `wc-multivendor-marketplace` plugin header","fix":null,"status":"open","published_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:48:03+00:00","updated_at":"2026-11-07T09:48:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:48:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WCFM Marketplace: missing authorization lets users reach restricted access levels","impact":"medium","summary":"WCFM Marketplace, a WooCommerce multivendor plugin, has a missing authorization check that lets an attacker exploit incorrectly configured access control levels. The affected range runs through version 3.8.3, and the impact is described only as access control weakness.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wcfm-marketplace"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users gain access restricted to other roles or vendors","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact affected roles or settings.","how_to_check":"- Check the installed WCFM Marketplace plugin version in the WordPress admin plugin list, or in `wc-multivendor-marketplace` plugin header\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-above-3.8.3"],"who_is_affected":"Sites running the WCFM Marketplace WordPress plugin (wc-multivendor-marketplace) at version 3.8.3 or earlier. The sources do not state which roles or settings are needed to exploit it, so treat any site with vendor accounts or custom access levels as in scope.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4229,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120849':13A,16A '-2026':12A,15A '3.8.3':50B,88C 'access':9A,41B,58B,77C 'affect':45B,82C 'allow':73C 'attack':37B 'author':4A,32B,62C 'check':33B 'configur':40B,76C 'control':42B,59B,78C 'cve':11A,14A 'describ':55B 'exploit':38B,74C 'impact':53B 'incorrect':39B,75C 'issu':81C 'let':5A,35B 'level':10A,43B 'levels.this':80C 'lover':66C 'marketplac':2A,20B,24B,68C,72C,84C 'miss':3A,31B,61C 'multivendor':27B,71C 'n/a':86C 'packag':17B 'plugin':28B 'rang':46B 'reach':7A 'restrict':8A 'run':47B 'secur':79C 'user':6A 'version':49B 'vulner':63C 'wc':65C,70C 'wc-multivendor-marketplac':69C 'wcfm':1A,19B,23B,67C,83C 'wcfm-marketplac':18B 'weak':60B 'woocommerc':21B,26B 'wordpress':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WCFM Marketplace WordPress plugin (wc-multivendor-marketplace) at version 3.8.3 or earlier. The sources do not state which roles or settings are needed to exploit it, so treat any site with vendor accounts or custom access levels as in scope.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wcfmmarketplace","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120849':13A,16A '-2026':12A,15A 'access':9A 'author':4A 'cve':11A,14A 'let':5A 'level':10A 'marketplac':2A 'miss':3A 'reach':7A 'restrict':8A 'user':6A 'wcfm':1A","search_b":"'3.8.3':50B 'access':41B,58B 'affect':45B 'attack':37B 'author':32B 'check':33B 'configur':40B 'control':42B,59B 'describ':55B 'exploit':38B 'impact':53B 'incorrect':39B 'let':35B 'level':43B 'marketplac':20B,24B 'miss':31B 'multivendor':27B 'packag':17B 'plugin':28B 'rang':46B 'run':47B 'version':49B 'wcfm':19B,23B 'wcfm-marketplac':18B 'weak':60B 'woocommerc':21B,26B 'wordpress':22B","search_c":"'3.8.3':88C 'access':77C 'affect':82C 'allow':73C 'author':62C 'configur':76C 'control':78C 'exploit':74C 'incorrect':75C 'issu':81C 'levels.this':80C 'lover':66C 'marketplac':68C,72C,84C 'miss':61C 'multivendor':71C 'n/a':86C 'secur':79C 'vulner':63C 'wc':65C,70C 'wc-multivendor-marketplac':69C 'wcfm':67C,83C","first_public_at":"2026-11-07T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120849","severity":null,"published_at":"2026-11-07T09:17:13+00:00","modified_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}