---
id: "CVE-2026-62000"
kind: "vulnerability"
aliases: ["CVE-2026-62000"]
title: "WCFM Marketplace WordPress plugin up to 3.8.2: unauthenticated broken access control"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wc-multivendor-marketplace", "fixed": ["3.8.3"], "affected": "<= 3.8.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "unauthenticated", "wcfm-marketplace", "woocommerce", "wordpress"]
not_affected_if: ["patched-3.8.3", "plugin-not-installed"]
published_at: "2026-11-04T07:17:12+00:00"
first_seen_at: "2026-11-04T07:25:30+00:00"
updated_at: "2026-11-04T07:27:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62000", "first_seen_at": "2026-11-04T07:25:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T07:27:57+00:00"}]
---

# WCFM Marketplace WordPress plugin up to 3.8.2: unauthenticated broken access control

WCFM Marketplace, a WordPress multivendor plugin by WC Lovers, has a missing authorization check that lets an attacker bypass access control settings. The sources state the affected range as all versions through 3.8.2 and a CVSS score of 7.5, but do not describe the exact action an attacker can take.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wc-multivendor-marketplace affected <= 3.8.2 fixed 3.8.3

## How to check

Run wp plugin get wc-multivendor-marketplace --field=version, or check the WordPress admin plugins list. 3.8.2 or older is affected; 3.8.3 or newer is patched per Patchstack. Also check for 3.8.3 because of the separate WPSEC-2026-2372 issue, fixed in 3.8.4.

## Fix

Update wc-multivendor-marketplace to 3.8.3 or later (Patchstack); 3.8.4 is the current release and also fixes a separate setup-wizard flaw

## Timeline

- 2026-11-04T07:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62000
- 2026-11-04T07:27:57+00:00 analyst — Patchstack (CNA, reporter mamgad, published 2 Nov 2026) lists Broken Access Control, unauthenticated, <=3.8.2, patched 3.8.3, CVSS 7.5. It does not say what the bypass grants. Not the vendor's own page and the wordpress.org changelog was not read, so nothing is marked verified. Latest release is 3.8.4. The WPSec issue (<=3.8.3, fixed 3.8.4, setup wizard plugin install) is a different bug; linked as mentions only. No exploitation or PoC found.

## Documents

- [advisory] Patchstack: WCFM Marketplace <= 3.8.2 Broken Access Control (CVE-2026-62000) https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-8-2-broken-access-control-vulnerability
- [mentions] WPSec: WCFM Marketplace <= 3.8.3 unauthenticated setup wizard access (separate issue) https://wpsec.com/vuln/WPSEC-2026-2372/

## From the sources

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_