PT-2026-33097 · WordPress · Wcfm Marketplace

CVE-2025-63029 · Published 2026-04-15 · Updated 2026-04-24

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions n/a through 3.7.1

Description Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection, allows for the execution of unauthorized SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-63029

Affected Products

Wcfm Marketplace

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-63029 · Security Note
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://patchstack.com/database/Wordpress/Plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-7-1-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2044737951007993985 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-7-1-sql-injection-vulnerability?_s_id=cve · Note