This vulnerability, identified as CWE-89, affects WC Vendors Marketplace versions <= 2.6.8 and allows an attacker with low privileges to perform SQL Injection via subscriber-related functionality. The CVSS 3.1 score of 8.5 reflects network attack vector, low attack complexity, privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is available at this time, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to service availability (low availability impact). Integrity of data is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to subscriber-related features and monitoring for suspicious activity related to SQL queries. Avoid exposing the vulnerable functionality to untrusted users where possible.