CVE-2026-18442: WCFM Marketplace WordPress SQL Injection

CVE-2026-18442 Overview

CVE-2026-18442 is a SQL injection vulnerability in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 3.8.2. The wcfmmp_user_location_lng parameter is not sufficiently escaped, and the underlying SQL query is not properly prepared. Unauthenticated attackers can append arbitrary SQL statements to the existing query and extract sensitive data from the database. The weakness is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Unauthenticated attackers can inject SQL over the network to read confidential data from WordPress sites running vulnerable versions of the WCFM Marketplace plugin.

Affected Products

• WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress
• All versions up to and including 3.8.2
• WordPress sites running the affected plugin versions

Discovery Timeline

• 2026-09-18 - CVE-2026-18442 published to NVD
• 2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-18442

Vulnerability Analysis

The vulnerability resides in how the WCFM Marketplace plugin handles the wcfmmp_user_location_lng request parameter. User-supplied input is concatenated into a SQL query without adequate escaping or use of parameterized statements. As a result, attackers can break out of the intended query context and append additional SQL syntax.

Because exploitation does not require authentication, any remote actor able to reach the affected endpoint can trigger the flaw. The attack vector is generic SQL injection, which enables data extraction via techniques such as UNION-based reads or Boolean/time-based inference. Impact is limited to confidentiality; the CVSS profile reports no integrity or availability impact.

Root Cause

The root cause is missing input sanitization combined with an unprepared SQL statement. The affected code paths process the wcfmmp_user_location_lng value in files such as core/class-wcfmmp-frontend.php, core/class-wcfmmp-shipping.php, helpers/wcfmmp-core-functions.php, and includes/shipping-gateways/class-wcfmmp-shipping-by-distance.php. Rather than binding the parameter through $wpdb->prepare(), the value flows into a query string that the database executes as SQL.

Attack Vector

An unauthenticated attacker sends an HTTP request to a WordPress endpoint exposed by the WCFM Marketplace plugin, supplying a crafted value for wcfmmp_user_location_lng. The malicious payload extends the intended query with attacker-controlled clauses, returning database records such as user credentials, session tokens, or private commerce data. Refer to the Wordfence Vulnerability Report and the WordPress WC Marketplace Changeset for the affected code paths and the corrective patch.

No verified proof-of-concept code is publicly available at this time. Exploitation follows standard SQL injection patterns against the vulnerable parameter.

Detection Methods for CVE-2026-18442

Indicators of Compromise

• HTTP requests containing SQL metacharacters such as UNION SELECT, SLEEP(, single quotes, or comment sequences within the wcfmmp_user_location_lng parameter.
• Unexpected outbound traffic or large response payloads from WordPress endpoints that handle vendor location or shipping lookups.
• Web server or WAF logs showing repeated requests to WCFM Marketplace endpoints from a single source with variations of the wcfmmp_user_location_lng value.

Detection Strategies

• Inspect WordPress access logs for query strings and POST bodies containing SQL syntax paired with the wcfmmp_user_location_lng parameter name.
• Enable database query logging on wp_* tables and alert on anomalous SELECT statements originating from plugin-driven queries.
• Deploy a WordPress-aware web application firewall with signatures for generic SQL injection targeting WCFM Marketplace endpoints.

Monitoring Recommendations

• Monitor for spikes in request volume, response size, or latency on endpoints served by the WCFM Marketplace plugin.
• Alert on database errors surfaced in application logs, which often accompany injection probing.
• Track plugin version inventory across managed WordPress sites and flag any host still running WCFM Marketplace 3.8.2 or earlier.

How to Mitigate CVE-2026-18442

Immediate Actions Required

• Update the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin to a version later than 3.8.2 that includes the vendor fix.
• Audit database accounts used by WordPress and rotate credentials, API keys, and session secrets if exploitation is suspected.
• Review recent access logs for requests referencing wcfmmp_user_location_lng to identify pre-patch exploitation attempts.

Patch Information

The vendor addressed the vulnerability in a subsequent release of the WCFM Marketplace plugin. Review the WordPress WC Marketplace Changeset for the exact code changes and update through the WordPress plugin repository. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, deactivate the WCFM Marketplace plugin until the update can be applied.
• Deploy WAF rules that block SQL syntax in the wcfmmp_user_location_lng parameter and enforce numeric-only validation upstream.
• Restrict access to WordPress admin and vendor endpoints by IP allowlisting where the deployment model permits.

# Example WAF rule (ModSecurity) blocking SQL syntax in the vulnerable parameter
SecRule ARGS:wcfmmp_user_location_lng "@rx (?i)(union(\s|/\*.*\*/)+select|select\s+.*\s+from|sleep\s*\(|benchmark\s*\(|--|;|/\*)" \
    "id:1026184420,phase:2,deny,status:403,log,msg:'CVE-2026-18442 WCFM Marketplace SQLi attempt'"