Skip to content
PluginCanary

WCFM

WCFM - Multivendor Marketplace REST API for WooCommerce
by WC Lovers · 1,000+ active installs · Checked 3 Nov 2026
Avoid1 Critical2 Warnings

Avoid: vulnerability published 5 Oct 2026 still has no fix after 14 days.

39/ 100 Canary Score

Capped at 39: a vulnerability has no patch.

Sub-scores for WCFM
Ownership100
Maintenance20
Security30
Support70
Reputation70

How the score works

Quick answers

Is WCFM still maintained?
No. Last release 6 Apr 2025, over 1 year ago. 6 Apr 2025 · wordpress.org
Who owns WCFM, and has it changed hands?
No change recorded. Main committer wclovers since Dec 2018. 3 Nov 2026 · SVN log
Was WCFM removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WCFM safe?
No. 1 known vulnerability has no fix in the current version. 5 Oct 2026 · Wordfence Intelligence
Is the latest WCFM update safe to install?
No ownership change before 1.6.3. No one-star spike after it. 6 Apr 2025 · Release history

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-2Vulnerability published 5 Oct 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.19 Oct 2026Evidence
  • WarningMNT-2Tested up to WordPress 6.7.11, 4 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
  • WarningMNT-1No release in 19 months (last release 6 Apr 2025). Plan a replacement if the plugin is important to your site.6 Apr 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master11 Dec 2018 to 11 Dec 2018, 1 commits
wclovers13 Dec 2018 to 6 Apr 2025, 52 commits

2 committers recorded. No ownership change since 2018.

Maintenance

Last release
19 months ago
Releases, 24 months
1
Tested up to
6.7 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WCFM
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20251
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

Last release 6 Apr 2025. Tested up to 6.7, 4 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Rating distribution
5 star5
4 star0
3 star0
2 star1
1 star0

Security record

2 vulnerabilities in 24 months (3 on record), 1 with no fix in the current version.

PublishedIssueCVSSAffectedFixed inDays to patch
5 Oct 2026WCFM - Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization5.3<= 1.6.3No fixn/a
Show 2 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
21 Mar 2025WooCommerce Multivendor Marketplace - REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection6.5<= 1.6.21.6.316
26 Apr 2023WooCommerce Multivendor Marketplace - REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API4.3<= 1.5.31.6.0Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

1,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WCFM
4 May 202637
11 May 202671
18 May 202650
25 May 202664
1 Jun 202647
8 Jun 202672
15 Jun 202658
22 Jun 202640
29 Jun 202652
6 Jul 202654
13 Jul 202651
20 Jul 202649
27 Jul 202661
3 Aug 202682
10 Aug 202665
17 Aug 202686
24 Aug 202678
31 Aug 202650
7 Sep 202664
14 Sep 202684
21 Sep 202683
28 Sep 2026139
5 Oct 2026137
12 Oct 202690
19 Oct 2026122
26 Oct 2026135
2 Nov 2026116

Weekly downloads over the last 4 weeks are 53% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

DokanScore 86 · 30,000+WCFM MembershipScore 84 · 10,000+WCFMScore 83 · 20,000+WCFM MarketplaceScore 81 · 10,000+

Facts

Version1.6.3
AuthorWC Lovers
Added13 Dec 2018
Last updated6 Apr 2025
Active installs1,000+
Requires WordPress4.4
Tested up to6.7.11
Requires PHP7.4
CategoryE-commerce & Shopping
Tagshttp api, rest-api, remote API, woocommerce marketplace api

Other plugins by this author: WCFM - Frontend Manager for WooCommerce, WCFM Membership - WooCommerce Memberships for Multivendor Marketplace, WCFM Marketplace - Multivendor Marketplace for WooCommerce, WCFM - WCFM Marketplace integrate Elementor, WCFM - Direct PayPal Pay for WooCommerce Multivendor Marketplace, Migrate to WooCommerce Multivendor Marketplace

Questions

Is WCFM still maintained?

No. Last release 6 Apr 2025, over 1 year ago.

Who owns WCFM, and has it changed hands?

No change recorded. Main committer wclovers since Dec 2018.

Was WCFM removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WCFM safe?

No. 1 known vulnerability has no fix in the current version.

Is the latest WCFM update safe to install?

No ownership change before 1.6.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue