WordPress security by component

WooCommerce Multivendor Marketplace – REST API

Plugin description

WooCommerce Multivendor Marketplace – REST API is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Mar 22, 2025; the highest CVE/CNA score is 6.5.

Plugin slug: wcfm-marketplace-rest-api

Latest vulnerability

CVE-2025-1311: WooCommerce Multivendor Marketplace – REST API: SQL injection

WooCommerce Multivendor Marketplace – REST API is affected by SQL injection. Exploitation requires at least subscriber-level access. A successful request can alter database queries and expose or modify WordPress data.

PublishedMar 22, 2025

Safe version guidanceSee mitigation notes

		Safe version
Mar 22, 2025	CVE-2025-1311 WooCommerce Multivendor Marketplace – REST API: SQL injection WooCommerce Multivendor Marketplace – REST API is affected by SQL injection. Exploitation requires at least subscriber-level access. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.5 NVDPending
Jun 09, 2023	CVE-2023-2275 WooCommerce Multivendor Marketplace – REST API: A security weakness WooCommerce Multivendor Marketplace – REST API is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD5.4