EUVD-2026-80174
GHSA-r99r-q28p-h387
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber account on target site
-
DeliverySend crafted request to vulnerable REST route
-
ExploitBypass missing ownership check
-
ExecutionOverwrite store payout/details and ownership record
-
ImpactRedirect vendor payouts / hijack store
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires any authenticated WordPress account on a site running MultiVendorX before 5.0.16 - the lowest role (subscriber) suffices, so sites with open user registration are effectively exposed to near-anonymous attackers. The specific prerequisite is that the MultiVendorX plugin is active and the vulnerable REST API route (which manages store details/payout settings) is reachable. The only meaningful limiting factor is that an authenticated session is needed (PR:L, no admin/vendor role required) and that user interaction is not required (UI:N); there is no dependency on a non-default configuration beyond having the plugin installed. |
| Impact | This is a genuine mid-tier priority, not an inflated CVSS score. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L = 7.1) is internally consistent with the description: network-reachable REST route, low complexity, and only low privileges (PR:L) needed - a WordPress subscriber account, which is the lowest authenticated tier and trivially obtainable on any site with open registration. Integrity impact is High because an attacker can overwrite arbitrary store details, payout settings, and the ownership record, while C:N (no direct data read) and A:L are reasonable. Signals partially conflict on urgency: a public exploit exists (WPScan-published PoC), which raises exploitability, but EPSS is only 0.17% (7th percentile) and there is no CISA KEV listing, indicating no confirmed mass exploitation yet. The low EPSS despite public PoC suggests opportunistic/targeted rather than widespread automated exploitation at this time. The real-world business risk is notable for marketplace operators because rewriting payout settings and store ownership is a direct financial-fraud/account-takeover vector, even though the raw score is only 'High'. |
| Exploit ScenarioDerived | An attacker registers or already holds a low-privilege subscriber account on a WooCommerce marketplace running MultiVendorX, then sends a crafted request to the vulnerable REST API route targeting a store they do not own. Because the route never checks store ownership, they overwrite that store's payout settings (redirecting vendor payments to themselves) and rewrite the ownership record. A public PoC from WPScan exists, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Broken access control in the MultiVendorX WordPress plugin (versions 5.0.0 through 5.0.15) allows any authenticated user, including a subscriber with no vendor privileges, to overwrite arbitrary stores' details and payout settings and to reassign a store's ownership record through a REST API route that fails to verify the caller owns the target store. Publicly available exploit code exists and the vendor has released a fixed version (5.0.16), so the primary exposure window is sites that have not yet updated; CISA KEV does not list this issue and the EPSS score is low (0.17%, 7th percentile), indicating speculative rather than mass-exploitation risk. The practical impact is high where open user registration is enabled, because a freshly created subscriber account is sufficient to tamper with merchant payout configuration and store ownership, and exploitation requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
RemediationAI
Upgrade MultiVendorX to 5.0.16 or later - the vendor-released patch (available per vendor advisory, tracked by WPScan at https://wpscan.com/vulnerability/35ff7d7e-b3fe-4ae2-92cd-a122b8cdd97c/) is the primary and complete fix and should be applied to every site where the plugin is active. If the update cannot be staged immediately, the most effective compensating control is to deactivate the plugin until patching is possible, accepting the loss of marketplace functionality; a narrower alternative is to block unauthenticated-to-low-privilege access to the plugin's REST endpoints (for example, deny requests under /wp-json/ matching the MultiVendorX namespace at the WAF, reverse proxy, or web server layer) while still allowing legitimate vendor and admin traffic, with the trade-off that route patterns must be tuned carefully or legitimate store management will break. Because the prerequisite is only an authenticated session, tightening registration is directly useful: disable open self-registration or require administrator approval for new accounts, and audit existing subscriber accounts, since this reduces but does not eliminate exposure from already-registered or compromised low-privilege users. Finally, treat data integrity as potentially compromised on any site that was running an unpatched version - review and restore store ownership records and payout/bank settings from a known-good source before resuming payouts, since tampering with payout configuration can redirect funds and is not corrected by upgrading alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MultiVendorX is a WordPress multi-vendor marketplace plugin that exposes store management functionality - store profile details, payout settings, and the ownership record linking a store to its vendor user - through WordPress REST API routes registered under the /wp-json/ namespace. The flaw is CWE-862 (Missing Authorization): the affected route lacks an effective capability and object-ownership check, so instead of confirming that the authenticated caller is the owner (or an administrator) of the store ID being modified, it accepts any authenticated session. In WordPress plugin development this typically means the route's permission_callback either returns true for any logged-in user or only checks a nonce/authentication state rather than performing an ownership or capability comparison such as current_user_can() against the target store. Because WordPress treats any valid logged-in session as authenticated, the lowest default role (subscriber) satisfies the check, and the request carries a full attacker-controlled store identifier, making this an object-level authorization failure (IDOR-style) rather than a privilege-escalation chain or a code-execution primitive - the integrity impact is on stored marketplace data, including payout routing, not on server execution. The supplied CPE, cpe:2.3:a:unknown:multivendorx:*:*:*:*:*:*:*:*, records the product without a resolved vendor namespace and without version constraints, so version scoping must be taken from the EUVD range (MultiVendorX 5.0.0 < 5.0.16) and the WPScan advisory rather than from the CPE itself.
Know when Multivendorx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network REST route with low complexity, exploitable by any authenticated low-privilege user (PR:L); overwriting store/payout/ownership records is a High integrity impact with only minor availability effect and no direct data disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Technical POC Analysis
CWE-862 (Missing Authorization), classified by WPScan as NO AUTHORISATION / OWASP A5: Broken Access Control.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MultiVendorX marketplace sites running versions 5.0.0 through 5.0.15 are exposed to an authenticated access-control flaw that can let any registered user, including a basic subscriber, alter merchant payout settings and reassign store ownership, undermining marketplace trust and creating direct financial-fraud risk. Publicly available exploit code exists, and CISA KEV does not list this issue, so exposure is greatest for unpatched sites with open registration rather than broad indiscriminate attacks. Leadership should prioritize rapid patching and verification of merchant payout and ownership records.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Multivendorx
View allBroken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (ve
Exploit-DB