CVE-2026-14196
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.
Risk Assessment
Competing vendors can manipulate reviews, potentially harming the reputation of other stores and misleading customers.
Recommendation
Update the plugin to version 3.8.1 or later, which includes fixes for review ownership verification.
Original NVD description (English source)
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.