Skip to main content

Product Catalog Enquiry CVE-2026-81792

| EUVDEUVD-2026-72644 MEDIUM
Incorrect Privilege Assignment (CWE-266)
2026-09-08 Patchstack GHSA-r7vv-8m42-6955
WordPress Privilege Escalation Multivendorx Wordpress Plugin Product Catalog Enquiry For Woocommerce By Multivendorx
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Unauthenticated network-accessible exploit with low complexity; impact bounded to low integrity and availability with no confidentiality exposure, consistent with a partial CWE-266 privilege escalation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Sep 08, 2026 - 07:55 vuln.today
CVE Published
Sep 08, 2026 - 07:15 cve.org
MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX <= 6.1.4 versions.

AnalysisAI

Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required (PR:N) and no user interaction is needed (UI:N), meaning any attacker with network access to the WordPress site's HTTP/HTTPS interface can attempt exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects a meaningful but bounded risk: the attack requires no authentication, no user interaction, and is network-accessible with low complexity, making automated exploitation trivially scriptable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Product Catalog Enquiry for WooCommerce by MultiVendorX plugin to a version beyond 6.1.4 once a patched release is published by MultiVendorX; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-catalog-enquiry/vulnerability/wordpress-product-catalog-enquiry-for-woocommerce-by-multivendorx-plugin-6-1-4-privilege-escalation-vulnerability?_s_id=cve for the confirmed fixed version, which was not specified in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Multivendorx

View all
CVE-2026-16605 HIGH POC
7.2 Aug 05

Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-5348 MEDIUM POC
6.1 Dec 18

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
CVE-2024-8289 CRITICAL
9.8 Sep 04

The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
CVE-2026-74927 MEDIUM POC
5.3 Sep 02

Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive
CVE-2024-25929 CRITICAL
9.1 Jun 09

Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c
CVE-2024-31304 HIGH
8.8 Jun 09

Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2026-66441 HIGH
7.5 Aug 13

Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 HIGH
7.5 Jun 09

CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
CVE-2026-16746 LOW POC
2.7 Aug 05

Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
CVE-2026-66651 MEDIUM
6.5 Aug 18

Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers t
CVE-2025-48263 MEDIUM
6.5 May 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX Multi

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-81792 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy