CVE-2025-63029: WCFM Marketplace SQL Injection Flaw

CVE-2025-63029 Overview

CVE-2025-63029 is an SQL injection vulnerability in the WC Lovers WCFM Marketplace plugin for WordPress, also known as wc-multivendor-marketplace. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all plugin versions up to and including 3.7.1. An authenticated attacker with high privileges can inject arbitrary SQL into backend queries over the network. Successful exploitation leads to confidentiality loss across the database scope, plus limited availability impact. The issue carries a scope change, meaning the impact extends beyond the vulnerable component to the underlying WordPress database.

Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database, including customer records, vendor details, and order information stored by the marketplace plugin.

Affected Products

WC Lovers WCFM Marketplace (wc-multivendor-marketplace) plugin for WordPress
All versions from initial release through 3.7.1
WordPress sites running the multivendor marketplace integration

Discovery Timeline

2026-04-15 - CVE-2025-63029 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-63029

Vulnerability Analysis

The WCFM Marketplace plugin enables multivendor commerce functionality on WooCommerce sites. The vulnerability resides in plugin code that constructs SQL queries using untrusted input without proper sanitization or parameterization. An attacker with high-privilege access can inject SQL fragments through plugin-exposed parameters. The injected SQL executes within the WordPress database context. Because the CVSS scope is changed, the affected database extends beyond the plugin's own data, allowing access to core WordPress tables such as wp_users and wp_usermeta. The attack requires authentication but no user interaction, making it suitable for malicious vendors or compromised administrative accounts.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin concatenates user-controlled input into SQL statements rather than using prepared statements with the WordPress $wpdb->prepare() API. Special characters such as single quotes, semicolons, and SQL keywords pass through unfiltered. This allows attackers to break out of the intended query context and append arbitrary clauses.

Attack Vector

The attack vector is network-based and requires an authenticated session with elevated privileges, such as a vendor or shop manager role. The attacker submits crafted input through plugin endpoints that flow into vulnerable SQL queries. No victim interaction is required. The exploitation typically involves UNION SELECT payloads or time-based blind injection techniques to exfiltrate data from arbitrary tables. Refer to the Patchstack Vulnerability Report for technical specifics.

Detection Methods for CVE-2025-63029

Indicators of Compromise

HTTP requests to WCFM Marketplace endpoints containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA
Anomalous database query patterns originating from the WordPress PHP process during vendor or marketplace operations
Unexpected outbound traffic from the web server following authenticated vendor sessions
Database error messages logged in PHP error logs referencing syntax errors in plugin queries

Detection Strategies

Inspect web server access logs for parameters containing encoded SQL syntax targeting /wp-admin/admin-ajax.php actions associated with WCFM
Enable MySQL general query logging temporarily to identify malformed queries originating from the plugin
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin endpoints
Correlate authenticated vendor account activity with database query anomalies

Monitoring Recommendations

Monitor for new or unexpected vendor account creation followed by abnormal query volumes
Alert on PHP errors referencing wpdb query failures from wc-multivendor-marketplace code paths
Track outbound data transfer volumes from the web server hosting the WordPress installation
Audit privileged WordPress role assignments and review vendor onboarding workflows

How to Mitigate CVE-2025-63029

Immediate Actions Required

Identify all WordPress installations running the WCFM Marketplace plugin at version 3.7.1 or earlier
Restrict or temporarily disable vendor registration until a patched version is deployed
Review existing vendor and shop manager accounts and remove any unauthorized privileged users
Audit recent database access logs for signs of injection attempts

Patch Information

At the time of NVD publication, the advisory lists affected versions through 3.7.1 with no fixed version explicitly documented in the available references. Administrators should consult the Patchstack Vulnerability Report and the WC Lovers vendor channel for the latest patched release, then update the plugin through the WordPress plugin manager.

Workarounds

Deactivate the WCFM Marketplace plugin until a verified patch is installed
Deploy a web application firewall ruleset that blocks SQL injection payloads targeting WordPress admin-ajax actions
Apply least-privilege principles to WordPress database credentials, restricting the WordPress user from accessing tables outside its required scope
Enforce strong authentication and multi-factor authentication for all vendor and administrative accounts

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate wc-multivendor-marketplace

# Audit user roles for unexpected privileged accounts
wp user list --role=shop_manager --fields=ID,user_login,user_email,user_registered
wp user list --role=wcfm_vendor --fields=ID,user_login,user_email,user_registered