This vulnerability (CVE-2026-66625) is an improper neutralization of special elements used in an SQL command (CWE-89) in WC Vendors Marketplace. Specifically, it is an administrator-level SQL Injection affecting versions up to 2.7.2.1. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, and requiring high privileges with no user interaction. The impact is a complete confidentiality breach and partial availability impact, with no integrity impact. No vendor advisory or patch information is provided in the data.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact) and partial denial of service (availability impact). Integrity is not impacted according to the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to SQL commands. Avoid exposing administrative interfaces unnecessarily.