{"id":"CVE-2026-62000","kind":"vulnerability","aliases":["CVE-2026-62000"],"related":[],"title":"WCFM Marketplace WordPress plugin up to 3.8.2: unauthenticated broken access control","description":"Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.","summary":"WCFM Marketplace, a WordPress multivendor plugin by WC Lovers, has a missing authorization check that lets an attacker bypass access control settings. The sources state the affected range as all versions through 3.8.2 and a CVSS score of 7.5, but do not describe the exact action an attacker can take.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wc-multivendor-marketplace","fixed":["3.8.3"],"affected":"<= 3.8.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","unauthenticated","wcfm-marketplace","woocommerce","wordpress"],"not_affected_if":["patched-3.8.3","plugin-not-installed"],"how_to_check":"Run wp plugin get wc-multivendor-marketplace --field=version, or check the WordPress admin plugins list. 3.8.2 or older is affected; 3.8.3 or newer is patched per Patchstack. Also check for 3.8.3 because of the separate WPSEC-2026-2372 issue, fixed in 3.8.4.","fix":"Update wc-multivendor-marketplace to 3.8.3 or later (Patchstack); 3.8.4 is the current release and also fixes a separate setup-wizard flaw","status":"open","published_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","triaged_at":"2026-11-04T07:26:22+00:00","updated_at":"2026-11-04T07:27:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T07:26:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WCFM Marketplace WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"WCFM Marketplace, a WordPress multivendor plugin by WC Lovers, has a missing authorization check that lets an attacker bypass access control settings. The sources state the affected range as all versions through 3.8.2 and a CVSS score of 7.5, but do not describe the exact action an attacker can take.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wcfm-marketplace"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass on a WooCommerce marketplace site","analyst_note":"Find the fixed version and the vendor advisory for WCFM Marketplace; the NVD entry only gives the range through 3.8.2 and does not say what the bypass grants.","how_to_check":"- Check the installed version of the WCFM Marketplace plugin (wc-multivendor-marketplace) in the WordPress admin plugins list, or `wp plugin get wc-multivendor-marketplace --field=version`\n- If the version is `3.8.2` or older, the sources say it is affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WCFM Marketplace WordPress plugin (wc-multivendor-marketplace) at version 3.8.2 or older are affected per the NVD entry. The sources do not say which configurations or roles are needed to reach the flaw, so whether a given store is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4128,"output_tokens":623,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vendor advisory for WCFM Marketplace; the NVD entry only gives the range through 3.8.2 and does not say what the bypass grants.","search":"'-2026':13A,16A '-62000':14A,17A '3.8.2':7A,61B,106C '7.5':67B 'access':10A,48B,95C 'action':74B 'affect':55B,100C 'allow':91C 'attack':46B,76B 'author':41B,80C 'broken':9A 'bypass':47B 'check':42B 'configur':94C 'control':11A,49B,96C 'cve':12A,15A 'cvss':64B 'describ':71B 'exact':73B 'exploit':92C 'incorrect':93C 'issu':99C 'let':44B 'levels.this':98C 'lover':37B,84C 'marketplac':2A,26B,30B,86C,90C,102C 'marketplace':21A 'miss':40B,79C 'multivendor':20A,33B,89C 'n/a':104C 'packag':22B 'plugin':4A,34B 'rang':56B 'score':65B 'secur':97C 'set':50B 'sourc':52B 'state':53B 'take':78B 'unauthent':8A,23B 'version':59B 'vulner':81C 'wc':19A,36B,83C,88C 'wc-multivendor-marketplac':87C 'wc-multivendor-marketplace':18A 'wcfm':1A,25B,29B,85C,101C 'wcfm-marketplac':24B 'woocommerc':27B 'wordpress':3A,28B,32B","nicknames":[],"mitigations":[],"who_affected":"Any WooCommerce multivendor store running the WCFM Marketplace plugin (wc-multivendor-marketplace) at 3.8.2 or older. Patchstack classes it as unauthenticated, so no login is needed. What the missing check exposes is not stated in the sources found. Sites on 3.8.3 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wcmultivendormarketplace"],"ptokens":["marketplace","multivendor","wc"],"labels":["high","package","unauthenticated","wcfmmarketplace","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62000","severity":null,"published_at":"2026-11-04T07:17:12+00:00","modified_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","fetched_at":"2026-11-04T07:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62000:1641","url":null,"severity":null,"published_at":"2026-11-04T07:27:57+00:00","modified_at":"2026-11-04T07:27:57+00:00","first_seen_at":"2026-11-04T07:27:57+00:00","fetched_at":"2026-11-04T07:27:57+00:00","note":"Patchstack (CNA, reporter mamgad, published 2 Nov 2026) lists Broken Access Control, unauthenticated, <=3.8.2, patched 3.8.3, CVSS 7.5. It does not say what the bypass grants. Not the vendor's own page and the wordpress.org changelog was not read, so nothing is marked verified. Latest release is 3.8.4. The WPSec issue (<=3.8.3, fixed 3.8.4, setup wizard plugin install) is a different bug; linked as mentions only. No exploitation or PoC found."}],"documents":[{"id":65118,"url":"https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-8-2-broken-access-control-vulnerability","title":"Patchstack: WCFM Marketplace <= 3.8.2 Broken Access Control (CVE-2026-62000)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":65119,"url":"https://wpsec.com/vuln/WPSEC-2026-2372/","title":"WPSec: WCFM Marketplace <= 3.8.3 unauthenticated setup wizard access (separate issue)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}