CVE-2025-49263: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-49263) was discovered in WCVendors WC Vendors Marketplace plugin versions through 2.5.6. The vulnerability was disclosed on June 5, 2025, and allows for Blind SQL Injection attacks when executed with administrator privileges (Patchstack).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 base score of 7.6 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H), and no user interaction (UI:N). The scope is changed (S:C) with high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L) (Patchstack).

The vulnerability could allow a malicious actor with administrator privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information. The severity is considered low priority despite the high CVSS score (Patchstack).

The vulnerability has been patched in version 2.5.7 of the WC Vendors Marketplace plugin. Users are advised to update to version 2.5.7 or later to remove the vulnerability (Patchstack).