{
 "id": "WPSEC-2026-0851",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0851/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0851/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0851/index.md",
 "title": "MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API",
 "description": "The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to unauthorized modification of data via the settings REST API endpoint in versions 5.0.0 through 5.0.19. This is due to the update_item_permissions_check function accepting the store owner 'edit_stores' capability as well as 'manage_options'. This makes it possible for authenticated attackers with store owner access to overwrite marketplace-wide MultiVendorX settings, such as commission, payout and store onboarding settings. Role permission settings are excluded.",
 "plugin": {
  "slug": "dc-woocommerce-multi-vendor",
  "name": "MultiVendorX",
  "full_name": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions",
  "wordpress_org": "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dc-woocommerce-multi-vendor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.0.0",
    "from_inclusive": true,
    "to": "5.0.20",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.0.0 before 5.0.20"
  ]
 },
 "introduced_in": "5.0.0",
 "fixed_in": "5.0.20",
 "remediation": "Update to 5.0.20 or later.",
 "fix_released": "2026-10-12T18:07:28+00:00",
 "published": "2026-10-13T20:09:59+00:00",
 "updated": "2026-10-13T12:13:41.452161+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0851/",
  "https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.20/",
  "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-13"
 }
}