CVE-2026-14196 Overview
CVE-2026-14196 is a broken access control vulnerability [CWE-639] in the WCFM Marketplace WordPress plugin versions prior to 3.8.1. The plugin fails to verify that a marketplace vendor owns a review before permitting unapproval or deletion actions. Any authenticated vendor can modify or permanently delete reviews belonging to other vendors' stores. The issue affects multi-vendor WordPress marketplaces that rely on WCFM to manage vendor storefronts and customer feedback.
Critical Impact
Authenticated vendors can tamper with or destroy competitor reviews, damaging integrity of vendor reputation data across the marketplace.
Affected Products
- WCFM Marketplace WordPress plugin versions before 3.8.1
- WordPress installations running multi-vendor marketplace configurations
- Any WCFM-based storefront exposing vendor dashboard endpoints
Discovery Timeline
- 2026-08-19 - CVE-2026-14196 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-14196
Vulnerability Analysis
The WCFM Marketplace plugin exposes review management actions to authenticated vendors through its vendor dashboard. When a vendor invokes the review unapproval or deletion endpoints, the plugin accepts a review identifier supplied by the client. The plugin does not confirm that the target review belongs to a product owned by the requesting vendor. This is a classic Insecure Direct Object Reference pattern in which the object key is trusted without an ownership check.
An attacker who registers as a vendor, or compromises any existing vendor account, can enumerate review IDs and issue requests referencing reviews owned by unrelated stores. The plugin executes the requested action against the referenced review without additional validation. Impact is limited to integrity of review data, with no direct confidentiality or availability effect on the underlying WordPress installation.
Root Cause
The root cause is a missing authorization check on the vendor-facing review management handlers. The plugin authenticates the caller and confirms the vendor role but omits verification that the review's parent product belongs to the caller. This maps to [CWE-639] Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires an authenticated account with vendor privileges and network access to the WordPress site. The attacker submits a crafted request to the vulnerable review action endpoint with a review ID belonging to another vendor. No user interaction from the victim vendor is required. See the WPScan Vulnerability Report for technical details.
No verified proof-of-concept code has been published. The vulnerability manifests in the review moderation handlers and can be tested by comparing the review's associated product_id and vendor_id against the requesting user's ID.
Detection Methods for CVE-2026-14196
Indicators of Compromise
- Unexpected transitions of review status from approved to unapproved or trash in the wp_comments table.
- Review deletions or state changes performed by a vendor account whose user_id does not match the parent product's author.
- Spikes in WCFM AJAX or REST requests targeting review moderation actions from a single vendor session.
Detection Strategies
- Correlate WordPress audit logs of comment deletion and status change events against the post_author of each review's parent product.
- Alert when the acting vendor differs from the product owner for any review moderation event.
- Baseline review deletion volume per vendor and flag statistical outliers.
Monitoring Recommendations
- Enable a WordPress activity log plugin that records review moderation actions with actor and target attribution.
- Forward web server access logs to a centralized log platform and retain them for at least 90 days.
- Monitor requests to WCFM vendor dashboard endpoints for anomalous parameter patterns referencing review IDs.
How to Mitigate CVE-2026-14196
Immediate Actions Required
- Update the WCFM Marketplace plugin to version 3.8.1 or later on all WordPress installations.
- Audit review moderation history for unauthorized status changes and restore affected reviews from backups where necessary.
- Review vendor account activity and disable accounts exhibiting cross-vendor review tampering.
Patch Information
The vendor addressed the missing ownership check in WCFM Marketplace version 3.8.1. Administrators should apply the patched release through the WordPress plugin updater or by replacing plugin files with the fixed version. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict vendor registration and require manual approval for new vendor accounts until the patch is applied.
- Temporarily disable vendor-side review moderation by removing review management capabilities from the vendor role.
- Place the vendor dashboard behind a Web Application Firewall rule that blocks review deletion requests where the review's product owner differs from the session user.
# Example: update WCFM Marketplace via WP-CLI
wp plugin update wc-multivendor-marketplace --version=3.8.1
wp plugin list --name=wc-multivendor-marketplace --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
