medium6.5
CVE-2026-81428
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authe…
Impact
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
Affected products
| Product | Affected versions |
|---|---|
| WC Vendors WordPress Plugin | before 2.7.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.