MultiVendorX CVE-2026-108695

Requires an authenticated account holding the store_owner (vendor) role with the edit_stores capability - the attacker must already be a registered vendor on the target marketplace. The core enabling condition is the flawed authorization gate: the /wp-json/multivendorx/v1/settings REST endpoint checks only edit_stores instead of an admin-level capability. The key limiting factor is therefore whether vendor registration is open/self-service (any attacker can obtain the required role) versus invite-only or manually approved (raising the barrier). No special non-default plugin configuration is otherwise required; any site running MultiVendorX through 5.0.19 with vendor accounts is affected. No user interaction and no victim admin action are needed.

This is a legitimate but moderate-priority issue, best characterized as a privilege-boundary (broken access control) flaw rather than a critical pre-auth RCE. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) scores 7.1 (High) and is internally consistent with the description: network-reachable REST endpoint, low complexity, and crucially PR:L - the attacker must already hold an authenticated low-privilege 'store_owner' (vendor) account. Impact is concentrated on integrity (VI:H - overwriting marketplace-wide commission/payout/onboarding settings) with only low availability impact (VA:L) and no confidentiality impact (VC:N), which matches a settings-tampering rather than data-exfiltration bug. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict, but several are simply absent: there is no EPSS probability to gauge real-world exploitation likelihood and no independent vendor patch confirmation. The real-world risk is gated primarily by whether the target marketplace allows open/self-service vendor registration - where it does, the PR:L barrier is trivially met by any attacker who signs up as a seller, raising practical risk closer to the 7.1 rating; on invite-only marketplaces the barrier is meaningfully higher. Reporter is VulnCheck (a credible source), lending confidence to the finding itself even absent NVD enrichment.

An attacker registers (or compromises) a vendor account with the store_owner role on a MultiVendorX-powered marketplace, then sends a crafted authenticated POST request to /wp-json/multivendorx/v1/settings. Because the endpoint only checks the edit_stores capability rather than an administrative capability, the request succeeds and the attacker rewrites marketplace-wide commission and payout settings - for example setting their own commission to 100% or redirecting payout configuration. No public exploit code or proof-of-concept was referenced in the provided data.