CVE-2026-81286: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WC Lovers WCFM Marketplace

This vulnerability (CVE-2026-81286) is an unauthenticated SQL Injection (CWE-89) in WC Lovers' WCFM Marketplace plugin, affecting all versions up to 3.8.1 inclusive. It allows remote attackers to inject SQL commands without any authentication, potentially compromising confidentiality of the database and causing partial availability impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed with high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the backend database due to SQL Injection. The vulnerability does not directly affect integrity but can cause partial denial of service. The critical CVSS score reflects the high confidentiality impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected WCFM Marketplace plugin versions (<=3.8.1) to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.