https://vulnerability.circl.lu/sightings/feed 2026-09-27T09:34:29.751705+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ce0ce306-3dd9-48ed-b07e-c8788548cea8/export 2026-09-27T09:34:29.774891+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ce0ce306-3dd9-48ed-b07e-c8788548cea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18442", "type": "seen", "source": "https://bsky.app/profile/cryptocat.me/post/3mvugnqpxd22x", "content": "Found an SQL injection in WCFM Marketplace, the WooCommerce multivendor plugin. A guest's checkout coordinates flow straight into a store-distance query, enough to read WordPress password hashes. CVE-2026-18442, fixed in 3.8.2, $134 bounty.\n\ncryptocat.me/blog/researc...", "creation_timestamp": "2026-09-19T10:05:20.821482Z"} 2026-09-19T10:05:20.821482+00:00 https://vulnerability.circl.lu/sighting/d9c67394-6dfb-4bdb-9857-c2975ccc4bcc/export 2026-09-27T09:34:29.777286+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d9c67394-6dfb-4bdb-9857-c2975ccc4bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18442", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvrol22qhr2n", "content": "CVE-2026-18442: the WCFM Marketplace plugin for WooCommerce (wclovers), versions up to and including 3.8.2, has an unauthenticated SQL injection flaw that can expose database contents. No exploitation confirmed. Update to the latest patched version.", "creation_timestamp": "2026-09-18T07:48:58.403780Z"} 2026-09-18T07:48:58.403780+00:00