WC Vendors, a WooCommerce multi-vendor marketplace plugin running on more than 10,000 active stores, has patched an authorization bypass flaw tracked as CVE-2026-81428. The bug, disclosed by WPScan on August 31, 2026, let any logged-in vendor tamper with product variations belonging to other vendors on the same marketplace, plus change the status and title of arbitrary posts. It carries a CVSS score of 6.5 (medium) and is fixed in version 2.7.2.1.
What Went Wrong in WC Vendors
The flaw is a classic insecure direct object reference, or IDOR. According to WPScan’s advisory, WC Vendors did not check who actually owned a product variation, or even confirm the object type, before saving changes submitted through the vendor dashboard. A vendor could pass in an ID belonging to a competitor’s listing and the plugin would process it anyway.
Researcher Usama Arshad reported the issue. On a healthy marketplace, that’s a nuisance. On one where vendors don’t fully trust each other (which describes most multi-vendor sites), it’s a real path to sabotage: quietly relabeling a rival’s bestseller, breaking its pricing, or flipping the status of posts that were never the vendor’s to touch in the first place.
Who Should Care
This only matters if you’re running WC Vendors specifically, not WooCommerce in general. If your site lets outside vendors list and manage their own products through it, patch to 2.7.2.1 now. There’s no indication of active exploitation yet, but the fix has been public since August 31, and IDOR bugs like this are simple enough to script that a delay of a few weeks is asking for trouble.
If you inherited a multi-vendor build from a previous developer and aren’t sure which plugin version is running, that’s worth checking today rather than assuming a routine update handled it. A WooCommerce Development audit is the kind of thing that catches exactly this: a marketplace plugin quietly running three versions behind while vendors are actively using it.
For marketplaces that outgrow what an off-the-shelf vendor plugin can safely isolate, a custom-built vendor dashboard with its own access checks (something we’ve done for clients before, like the partner portal in CasaFixx) removes this whole class of bug rather than patching around it release by release.
