WCFM Marketplace CVE-2026-18442: Update Past the Checkout SQL Injection
WCFM Marketplace fixed an unauthenticated SQL injection in its distance-based shipping path in version 3.8.2, released August 25, 2026. The flaw, tracked as CVE-2026-18442, affects the checkout flow when specific WCFM Marketplace and WooCommerce shipping features are enabled. The WordPress.org directory has since moved to 3.8.3, so operators should update to the current release instead of stopping at the first fixed build.
Security researcher Ivaylo Atanassov reports that the vulnerable range begins with 3.3.9 and runs through 3.8.1. The attack is reachable without an authenticated WordPress account and can expose database contents through a blind SQL-injection channel. The demonstrated impact included reading a stored wp_users.user_pass password hash.
The exploit path has configuration prerequisites. It relies on the classic WooCommerce checkout, WCFM store shipping, by-distance shipping, and a shippable vendor product using that method. Those conditions give administrators a concrete exposure check while they patch.
What was vulnerable
WCFM Marketplace can calculate a vendor's distance from a shopper using latitude and longitude supplied during checkout. In the affected code, checkout coordinates were stored as text and later interpolated into the SQL expression used for the store-distance calculation.
The query used $wpdb->prepare() for the vendor ID, while the latitude and longitude values had already been inserted into the query text. As a result, attacker-controlled coordinate input could alter the SQL expression.
Atanassov demonstrated the issue through WooCommerce's public update_order_review checkout request. The published proof of concept used blind inference to recover bytes from wp_users.user_pass. This establishes database-read impact under the WordPress database account; it does not establish remote code execution.
Affected and fixed versions
| Item | Status |
|---|---|
| Vulnerability | CVE-2026-18442 |
| Product | WCFM Marketplace – Multivendor Marketplace for WooCommerce |
| Researcher-confirmed affected range | 3.3.9 through 3.8.1 |
| First source-confirmed fixed release | 3.8.2 |
| Current release during this review | 3.8.3 |
| Authentication required | No |
| Demonstrated impact | Blind database read |
| Relevant feature | By-distance shipping during classic checkout |
The 3.8.2 WordPress.org changelog identifies the same vulnerability and says store-distance calculations now force incoming location coordinates to numeric values before database use. The code change casts the latitude and longitude values with floatval() inside the shared distance helper.
Version 3.8.3 contains additional security fixes and retains the SQL-injection correction. Updating to the current release therefore provides the appropriate operational target.
Why version records require care
The researcher's patch diff and the plugin's own changelog place the SQL-injection fix in 3.8.2. Atanassov also notes that a Wordfence record lists versions through 3.8.2 as affected and 3.8.3 as fixed. The source diff and official plugin changelog provide stronger evidence for the code-level fix point, while the safest deployment action is the same under either record: install 3.8.3 or later.
This discrepancy matters for historical exposure analysis. Administrators investigating whether a site was vulnerable during August should record the exact installed build and configuration instead of relying on a single secondary affected-version field.
Check whether a site exposed the vulnerable path
Prioritize sites where all of the following were present during the vulnerable period:
- WCFM Marketplace and its required WooCommerce/WC Frontend Manager components were active.
- The site used the classic WooCommerce checkout flow.
- WCFM store shipping and by-distance shipping were enabled.
- At least one shippable vendor product used by-distance shipping.
A site that met these conditions exposed the vulnerable query path to guest checkout traffic. Configuration review is useful for triage, while upgrading remains the durable remediation.
Remediation
Update WCFM Marketplace to 3.8.3 or a later current release and verify the active plugin version after deployment. Sites that cannot update immediately can remove the vulnerable path by disabling WCFM by-distance shipping or WCFM store shipping until the update is complete.
For higher-value WooCommerce installations, preserve relevant web and application logs before routine retention removes them. Review unusual repeated checkout update_order_review activity, especially traffic manipulating WCFM location fields or generating abnormal request latency. A clean log review cannot prove absence of exploitation, but it can identify conspicuous probing around the vulnerable endpoint.
Database credentials should follow normal least-privilege practice. The demonstrated flaw executes reads with the permissions available to the WordPress database account, so unnecessarily broad database grants increase the potential scope of a successful SQL injection.
Bottom line
CVE-2026-18442 is a configuration-dependent but unauthenticated database-read vulnerability in a public WooCommerce checkout path. WCFM Marketplace's own changelog and the published patch analysis show the vulnerable coordinate handling corrected in 3.8.2, and 3.8.3 is the appropriate minimum operational target today because it includes that correction plus subsequent security fixes.
Administrators should update first, then use the site's historical checkout and shipping configuration to determine whether deeper log review is warranted.
Sources: WCFM Marketplace on WordPress.org, Ivaylo Atanassov's CVE-2026-18442 technical analysis, and NVD CVE-2026-18442.