WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
Priority MEDIUM 53CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Why it matters now
EPSS 0.08389 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WCFM Marketplace – Best Multivendor Marketplace for WooCommerce (Unknown): 3.4.12
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WCFM Marketplace – Best Multivendor Marketplace for WooCommerce | 3.4.12 to before 3.4.12 | 3.4.12 | Patch available | CNA |
- WCFM Marketplace – Best Multivendor Marketplace for WooCommerce VendorUnknown Affected 3.4.12 to before 3.4.12 Fixed in 3.4.12 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wclovers:frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible:*:*:*:*:*:wordpress:*:* | before 3.4.12 | Vulnerable | wclovers |
- cpe:2.3:a:wclovers:frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible:*:*:*:*:*:wordpress:*:* Versions before 3.4.12 Vulnerable ·wclovers
Remediation
- Fix · CNA WCFM Marketplace – Best Multivendor Marketplace for WooCommerce (Unknown) Fixed in 3.4.12
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24849
- 2026-10-03 Alias added: GHSA-2hw2-7jq8-w9vp
- 2026-10-14 EPSS moved to the 95th–99th percentile
- 2026-10-25 EPSS moved to the 90th–95th percentile
- 2026-11-06 EPSS moved to the 95th–99th percentile
References
More wclovers Frontend Manager For Woocommerce Along With Bookings Subscription Listings Compatible vulnerabilities
- TI-2024-07686 Authorization bypass in wclovers WCFM – Frontend Manager for WooCommerce CVSS 3.1HIGH 8.8
- TI-2021-07117 WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection CVSS 3.1HIGH 8.8
- TI-2022-04528 Missing authorization in wclovers WCFM – Frontend Manager for WooCommerce along with… CVSS 3.1HIGH 8.8
- TI-2022-04529 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery CVSS 3.1HIGH 8.8
- TI-2025-03330 Missing authorization in wclovers WCFM – Frontend Manager for WooCommerce CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-24849 · CVE Program
- CVE-2021-24849 · NVD
- FIRST EPSS
- GHSA-2hw2-7jq8-w9vp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences