MultiVendorX CVE-2026-74925

The attacker must hold a valid vendor-role account on the target WordPress site running MultiVendorX < 5.0.16. No additional configuration is required - any site with vendor accounts enabled is vulnerable by default. Exploitation is limited to sites where (1) MultiVendorX is installed and active, (2) at least one vendor account exists or vendor registration is open to attackers, and (3) the plugin version predates 5.0.16. Sites that have never enabled the vendor role or have no external vendor accounts are not exploitable in practice. Authentication as a vendor (PR:L effectively) is the only meaningful barrier.

The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (score 7.2), but PR:H is inconsistent with the described attack: the vendor role is a low-privileged marketplace seller, not an administrator. PR:L would be technically more accurate, which would raise the score to approximately 8.8. This discrepancy means the CVSS score likely understates real-world risk on multi-vendor marketplace sites where many untrusted third-party sellers register as vendors. No KEV listing was identified, so active exploitation in the wild is not confirmed. However, a publicly available exploit from WPScan substantially lowers the barrier to exploitation. The impact is maximum - full site takeover including C:H/I:H/A:H - making this a high operational priority for any site running MultiVendorX with external vendor registrations. The AC:L rating is appropriate: no special race condition, token, or configuration variation is needed.

An attacker registers as a vendor on a MultiVendorX-powered WooCommerce marketplace (or uses an existing vendor account) and directly calls the unprotected role/capability settings update endpoint, appending administrator-level capabilities to the vendor role definition. On next login - or immediately if session is retained - the attacker's vendor account possesses full WordPress admin rights, allowing plugin installation, arbitrary PHP code execution, data exfiltration, and complete site compromise. A public exploit walkthrough is available via WPScan.