EUVD-2026-69835
GHSA-vwqj-46fj-33p7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress + MultiVendorX version
-
ExploitSend unauthenticated GET to REST API listing route
-
ExecutionReceive vendor contact and payout JSON response
-
ImpactHarvest sensitive marketplace data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the target running MultiVendorX below 5.0.15 on a publicly accessible WordPress installation with the REST API enabled (the WordPress REST API is enabled by default). The vulnerable route is a standard REST API listing endpoint that requires no authentication, no session token, and no special HTTP headers. Exploitation is limited to read-only access of vendor/payout/application data; no write, code execution, or privilege escalation capability is present. Sites that have explicitly disabled the WordPress REST API via filter or hosting controls are not exposed. |
| Impact | CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a straightforward, unauthenticated network-accessible read. While the CVSS score is only Medium, the real-world sensitivity of the exposed data - vendor payout amounts, contact details, and internal administrative notes on store applications - may exceed a generic C:L designation for marketplace operators, as this data could be leveraged for targeted fraud, phishing of vendors, or competitive intelligence. EPSS data is absent from provided input; however, the existence of a public WPScan PoC lowers the exploitation bar significantly. No KEV listing is present, so confirmed active exploitation is not established. The low complexity and zero-privilege requirement mean automated scanning and opportunistic exploitation are realistic. The primary mitigating factor is that this is read-only with no integrity or availability impact. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress marketplace powered by MultiVendorX below 5.0.15 through passive reconnaissance (e.g., wappalyzer fingerprinting or WPScan enumeration). The attacker sends a crafted unauthenticated GET request to the vulnerable REST API listing route, receiving a JSON response containing all vendor contact details, payout amounts, and internal administrative notes. A public WPScan PoC documents the exact endpoint and request format, lowering the skill barrier to near zero. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive marketplace data through an improperly secured REST API listing route. Any unauthenticated remote attacker can query the endpoint to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. A publicly available exploit code exists via WPScan, and a vendor patch has been released in version 5.0.15.
RemediationAI
Vendor-released patch: MultiVendorX 5.0.15. Update the plugin immediately via the WordPress admin dashboard (Plugins → Updates) or download directly from the WordPress plugin repository. No workarounds are documented by the vendor; however, site administrators unable to update immediately can restrict REST API access to authenticated users globally via a custom WordPress filter (add_filter('rest_authentication_errors', ...)) or using a security plugin such as Wordfence or Solid Security with REST API restrictions enabled - note this may break other plugins relying on public REST endpoints. Review any marketplace vendor data for potential prior unauthorized access by auditing REST API access logs for requests to the affected listing route. Advisory reference: https://wpscan.com/vulnerability/c81aa489-0663-40b7-b2ce-f4c8f2edd4b6/
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MultiVendorX is a WordPress plugin that transforms WooCommerce installations into multi-vendor marketplaces. The vulnerability resides in a REST API listing route that fails to implement WordPress capability or nonce checks before returning sensitive vendor and application data (CWE-862: Missing Authorization). WordPress REST API endpoints are publicly reachable by default, meaning the absence of an authorization gate on this route makes the sensitive data directly accessible over HTTP. The affected CPE string is cpe:2.3:a:unknown:multivendorx:*:*:*:*:*:*:*:* covering all versions up to but not including 5.0.15, confirmed by EUVD as versions 5.0.13 through below 5.0.15.
Know when Multivendorx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable REST API, zero prerequisites, read-only impact limited to partial vendor/payout data, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Multivendorx
View allBroken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Broken access control in the MultiVendorX WordPress plugin (versions 5.0.0 through 5.0.15) allows any authenticated user
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c
Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite
Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (ve
Exploit-DB