CVE-2026-39794: WooCommerce Multivendor Auth Bypass Flaw

CVE-2026-39794 Overview

CVE-2026-39794 is an unauthenticated broken access control vulnerability [CWE-862] in the WooCommerce Multivendor Marketplace – REST API plugin for WordPress. Affected versions include 1.6.3 and earlier. The flaw allows network-based attackers to access restricted REST API functionality without authentication or user interaction.

The vulnerability permits exposure of confidential marketplace data handled by the plugin. Site operators running multivendor storefronts face risk of information disclosure through unauthorized REST endpoint access. Patchstack published the vulnerability analysis as the primary technical reference.

Critical Impact
Unauthenticated remote attackers can bypass access controls in the WCFM Marketplace REST API plugin and retrieve data that should require authorization.

Affected Products

WooCommerce Multivendor Marketplace – REST API plugin for WordPress
Plugin versions 1.6.3 and earlier
WordPress sites running the WCFM Marketplace REST API extension

Discovery Timeline

2026-10-06 - CVE-2026-39794 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-39794

Vulnerability Analysis

The plugin exposes REST API endpoints that fail to enforce authorization checks before processing requests. An attacker sends HTTP requests to the vulnerable endpoints directly over the network. The server returns data or performs actions that should be gated behind authentication.

The CWE-862 classification (Missing Authorization) indicates the application does not verify whether the caller holds the required privileges. The CVSS vector shows confidentiality impact without integrity or availability impact. The flaw therefore primarily enables information disclosure from the marketplace REST surface.

Exploitation requires no credentials, no user interaction, and low attack complexity. Attackers can automate discovery and extraction against any internet-reachable WordPress site running a vulnerable plugin version. The EPSS probability currently sits at 0.394% (31.4 percentile).

Root Cause

The root cause is missing authorization logic in one or more REST API route handlers registered by the WCFM Marketplace REST API plugin. Route definitions likely use a permissive permission_callback such as __return_true or an equivalent check that does not validate the requester's capability. Without a proper capability check, WordPress treats the request as authorized.

Attack Vector

The vulnerability is exploitable over the network against the WordPress REST API base path. An unauthenticated attacker issues a crafted HTTP request to the affected plugin route. The server processes the request and returns data without validating the caller.

The vulnerability manifests in the plugin's REST route registration logic. See the Patchstack Vulnerability Analysis for route-level technical details.

Detection Methods for CVE-2026-39794

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/ paths associated with the WCFM Marketplace REST API plugin.
High volumes of REST API calls from a single source IP enumerating marketplace resources.
Access log entries returning HTTP 200 responses for REST endpoints without a preceding authentication exchange.

Detection Strategies

Inventory WordPress installations and identify sites running wcfm-marketplace-rest-api at version 1.6.3 or earlier.
Alert on anonymous requests to plugin-specific REST routes under /wp-json/wcfm/ or related namespaces.
Correlate web server logs with WordPress audit logs to detect REST responses lacking an authenticated session cookie or application password.

Monitoring Recommendations

Enable verbose access logging on the WordPress reverse proxy or web application firewall for all /wp-json/ traffic.
Baseline normal REST API request patterns per site and alert on deviations in volume or endpoint diversity.
Monitor the Patchstack and WordPress plugin repository feeds for a patched release of the affected plugin.

How to Mitigate CVE-2026-39794

Immediate Actions Required

Identify all WordPress sites running the WooCommerce Multivendor Marketplace – REST API plugin at version 1.6.3 or earlier.
Deactivate the plugin on affected sites until a patched version is available and verified.
Restrict access to the WordPress REST API at the web application firewall for routes exposed by this plugin.

Patch Information

No fixed version is listed in the enriched data at the time of publication. Monitor the Patchstack Vulnerability Analysis and the official WordPress plugin page for a release that resolves the missing authorization check.

Workarounds

Block anonymous requests to the plugin's REST namespace at the WAF or reverse proxy layer.
Enforce IP allow-listing on /wp-json/ endpoints used only by trusted integrations.
Require application passwords or authenticated sessions for all REST API traffic to the WordPress instance.

bash

# Example nginx snippet to block unauthenticated access to the plugin REST namespace
location ~ ^/wp-json/wcfm/ {
    if ($http_authorization = "") {
        return 403;
    }
}