Product Catalog Enquiry For Woocommerce By Multivendorx
Monthly
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.