The WCFM Marketplace WordPress plugin versions prior to 3.8.1 do not properly verify that a marketplace vendor owns a review before permitting actions to unapprove or delete it. This lack of ownership verification constitutes an authorization bypass (CWE-639), allowing any vendor to modify or delete reviews of other vendors' stores. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability.

An attacker with vendor privileges can modify or permanently delete reviews of other vendors, potentially damaging reputations or manipulating marketplace feedback. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Upgrade the WCFM Marketplace plugin to version 3.8.1 or later, where this authorization bypass vulnerability is fixed. No other mitigation guidance is provided by the vendor advisory. Patch status is confirmed by the version boundary in the affectedVersions field.