The WC Vendors plugin for WordPress, including WooCommerce Multivendor, WooCommerce Marketplace, and Product Vendors, suffers from a generic SQL Injection vulnerability identified as CVE-2026-15351. This vulnerability affects all versions up to and including 2.7.0. It is caused by improper neutralization of special elements in SQL commands (CWE-89), specifically the 'status' parameter, which is insufficiently escaped and improperly prepared in SQL queries. Authenticated attackers with shop manager-level privileges or higher can exploit this flaw to inject additional SQL commands, potentially extracting sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and WordPress's wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before sanitization.

An attacker with shop manager-level access or higher can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, as the CVSS vector indicates high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only. Monitor vendor channels for updates and apply any official patches once released.