EUVD-2026-37674Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Privilege escalation in TechSpawn MultiLoca (WooCommerce Multi Locations Inventory Management) plugin versions 4.2.15 and earlier allows authenticated subscriber-level users to elevate their privileges within affected WordPress sites. The flaw, classified under CWE-266 (Incorrect Privilege Assignment), carries a CVSS 7.6 score with no public exploit identified at time of analysis. The vulnerability was disclosed via Patchstack and affects WordPress installations running the plugin for WooCommerce multi-location inventory management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Multiloca gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.
Executive ViewAI
The TechSpawn MultiLoca WooCommerce plugin (versions 4.2.15 and earlier) contains a privilege escalation vulnerability allowing subscriber-level WordPress users to gain unauthorized administrative capabilities on affected sites. Organizations deploying this plugin for multi-location e-commerce inventory management face direct risk to transaction integrity, customer data, and operational control. Immediate inventory and mitigation steps are critical because no vendor patch is currently available.
Within 24 hours: Identify all WordPress installations running TechSpawn MultiLoca and document current plugin versions. Within 7 days: Audit subscriber user accounts on affected systems; restrict subscriber account creation and remove unnecessary accounts if feasible; enable comprehensive admin action logging. Within 30 days: Contact Patchstack and vendor for patch timeline; evaluate alternative e-commerce inventory plugins; prepare upgrade or migration plan if vendor does not release a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict subscriber account creation to authorized users only; limit subscriber capabilities through WordPress role configuration; implement Web Application Firewall rules to detect privilege escalation patterns; establish real-time alerts for unexpected privilege grants or admin account modifications; monitor server access logs for unauthorized account privilege changes; consider immediate migration to actively maintained alternative inventory management plugins if plugin is business-critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB