CVE-2026-14196

MediumCVSS 4.3

Published: 19/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

Risk Assessment

Competing vendors can manipulate reviews, potentially harming the reputation of other stores and misleading customers.

Recommendation

Update the plugin to version 3.8.1 or later, which includes fixes for review ownership verification.

Other vulnerabilities in WCFM Marketplace WordPress plugin

CVE-2026-77701Medium
The WCFM Marketplace WordPress plugin before version 3.8.2 does not correctly verify that the person requesting a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the site.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS