Multivendorx
CVE-2024-25929
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.
AnalysisAI
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Affected products include: Multivendorx Product Catalog Mode For Woocommerce. Version information: through 5.0.5..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.
More in Multivendorx
View allBroken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers t
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX Multi
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (ve
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today