# MultiVendorX <= 5.0.19 - Authenticated (Store Owner+) Missing Authorization to Global Settings Update via REST API

- **ID:** WPSEC-2026-0851
- **Plugin:** MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (`dc-woocommerce-multi-vendor`), https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
- **Affected versions:** from 5.0.0 before 5.0.20
- **Fixed in:** 5.0.20 (Update to 5.0.20 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0851/

## Description

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to unauthorized modification of data via the settings REST API endpoint in versions 5.0.0 through 5.0.19. This is due to the update_item_permissions_check function accepting the store owner 'edit_stores' capability as well as 'manage_options'. This makes it possible for authenticated attackers with store owner access to overwrite marketplace-wide MultiVendorX settings, such as commission, payout and store onboarding settings. Role permission settings are excluded.

## References

- https://wpsec.com/vuln/WPSEC-2026-0851/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.20/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0851/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.