EUVD-2026-69835
GHSA-vwqj-46fj-33p7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable REST API, zero prerequisites, read-only impact limited to partial vendor/payout data, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
AnalysisAI
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target running MultiVendorX below 5.0.15 on a publicly accessible WordPress installation with the REST API enabled (the WordPress REST API is enabled by default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a straightforward, unauthenticated network-accessible read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: MultiVendorX 5.0.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multivendorx
View allBroken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers t
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX Multi
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (ve
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today