CVE-2026-12951 wcmp CVE debrief

Who should care

WordPress administrators and security teams, especially those with Dc Woocommerce Multi Vendor plugin installations, should assess exposure and prioritize remediation. Vendors with 'edit_stores' capability are at risk and should take immediate action to protect their installations.

Why it matters

CVE-2026-12951 SQL Injection vulnerability in Dc Woocommerce Multi Vendor plugin for WordPress requires assessment and remediation for WordPress installations, especially for vendors with 'edit_stores' capability.

• Authenticated attackers with 'edit_stores' capability can potentially extract sensitive information from the database
• SQL Injection vulnerability requires verification of database security and access controls
• Vendor-level access can be used to exploit this vulnerability
• Remediation priority is elevated for WordPress installations with multiple vendors

Technical summary

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The value is concatenated directly into an ORDER BY clause where esc_sql() provides limited protection. Authenticated attackers with vendor-level access and above (users granted the 'edit_stores' capability) can append additional SQL queries into existing queries to potentially extract sensitive information from the database.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Dc Woocommerce Multi Vendor plugin, especially for vendors with 'edit_stores' capability.

Recommended defensive actions

• Assess WordPress installations for Dc Woocommerce Multi Vendor plugin version 5.0.18 or earlier
• Restrict 'edit_stores' capability to trusted vendors
• Monitor for suspicious database queries
• Consider upgrading to a patched version when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information from the database. However, specific details about exploitation and impact are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.