CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

Published Sep 2, 2026
CVSS 9.3 critical
0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

WC Lovers WCFM Marketplace

CVE-2026-81286 at the National Vulnerability Database