{"vulnerability": "CVE-2026-18442", "sightings": [{"uuid": "d9c67394-6dfb-4bdb-9857-c2975ccc4bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18442", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvrol22qhr2n", "content": "CVE-2026-18442: the WCFM Marketplace plugin for WooCommerce (wclovers), versions up to and including 3.8.2, has an unauthenticated SQL injection flaw that can expose database contents. No exploitation confirmed. Update to the latest patched version.", "creation_timestamp": "2026-09-18T07:48:58.403780Z"}, {"uuid": "ce0ce306-3dd9-48ed-b07e-c8788548cea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18442", "type": "seen", "source": "https://bsky.app/profile/cryptocat.me/post/3mvugnqpxd22x", "content": "Found an SQL injection in WCFM Marketplace, the WooCommerce multivendor plugin. A guest's checkout coordinates flow straight into a store-distance query, enough to read WordPress password hashes. CVE-2026-18442, fixed in 3.8.2, $134 bounty.\n\ncryptocat.me/blog/researc...", "creation_timestamp": "2026-09-19T10:05:20.821482Z"}]}