WC Vendors Marketplace

WC Vendors before 2.7.2.1 does not verify ownership or object type when saving user-supplied product-variation IDs. An authenticated vendor can modify another vendor's variations and can change the status and title of arbitrary posts.

WC Vendors before 2.7.2.1 does not verify that a vendor owns the order referenced by a front-end shipment-status request. Any authenticated vendor can mark another vendor's order as shipped, add a note falsely attributed to that vendor, and trigger a customer shipment email.

WC Vendors is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is < 2.7.2.1.

WC Vendors through 2.7.0 accepts a Shop Manager-controlled status value through its REST API and uses it in SQL without adequate preparation. sanitize_text_field() removes HTML but not SQL metacharacters, and the REST server unslashes GET parameters before sanitization. A Shop Manager can therefore append SQL and extract sensitive database information. The public.

WC Vendors Marketplace is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.6.8.

WC Vendors Marketplace is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.