CVE-2026-120849: WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability

Q: Which installations are affected?

Installations running WCFM Marketplace versions through 3.8.3 are affected. The available data does not identify a fixed version.

Q: What access does an attacker need to exploit this issue?

The available information identifies the flaw as missing authorization caused by incorrectly configured access-control security levels, but it does not state whether authentication or a particular user role is required.

Q: How can I determine whether my site is affected?

Check whether WCFM Marketplace is installed and determine its installed version. Versions up to and including 3.8.3 fall within the stated affected range.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WCFM Marketplace to a version that resolves this vulnerability.
Fixed in 3.8.4

Event History

Nov 7, 2026

CVE Published

via MITRE·08:53 AM

Data Sourced

via MITRE·08:53 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Installations running WCFM Marketplace versions through 3.8.3 are affected. The available data does not identify a fixed version.

What access does an attacker need to exploit this issue?

The available information identifies the flaw as missing authorization caused by incorrectly configured access-control security levels, but it does not state whether authentication or a particular user role is required.

How can I determine whether my site is affected?

Check whether WCFM Marketplace is installed and determine its installed version. Versions up to and including 3.8.3 fall within the stated affected range.

CVE-2026-120849: WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site is affected?