Vulnerabilities / MultiVendorX / WPSEC-2026-0851
MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API
Medium 4.3
CWE-863Fixed in 5.0.20
- ID
- WPSEC-2026-0851
- Plugin
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (dc-woocommerce-multi-vendor)
- Affected
- from 5.0.0 before 5.0.20
- Remediation
- Update to 5.0.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-13
- Attack surface
- MultiVendorX on WPSec AttackSurface
- Fix released
- Published
Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to unauthorized modification of data via the settings REST API endpoint in versions 5.0.0 through 5.0.19. This is due to the update_item_permissions_check function accepting the store owner 'edit_stores' capability as well as 'manage_options'. This makes it possible for authenticated attackers with store owner access to overwrite marketplace-wide MultiVendorX settings, such as commission, payout and store onboarding settings. Role permission settings are excluded.
References
- https://wpsec.com/vuln/WPSEC-2026-0851/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.20/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS