CVE-2026-62000

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-620019.8Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.CVE-2026-620029.8Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.CVE-2026-620039.8Unauthenticated PHP Object Injection in Mission <= 1.22 versions.CVE-2026-620049.8Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.CVE-2026-620059.8Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.CVE-2026-620069.8Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.CVE-2026-620077.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements CVE-2026-620089.8Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.CVE-2026-620099.8Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.CVE-2026-62015.4A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.CVE-2026-620109.8Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-620119.8Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVE-2026-62000: High severity, CVSS 7.5 | Vulnix