MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) PHP Object Injection via Store Registration Data
- ID
- WPSEC-2026-1989
- Plugin
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (dc-woocommerce-multi-vendor)
- Affected
- from 5.0.0 before 5.0.21
- Remediation
- Update to 5.0.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to PHP Object Injection via the store phone field of store registration in versions 5.0.0 through 5.0.20, due to deserialization of untrusted input with maybe_unserialize() in StoreUtil::get_phone(). Any logged-in user can register a store. A serialized string supplied as the phone number is stored by update_meta() and decoded again when the store's phone is displayed. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1989/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.21/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS