{
 "id": "WPSEC-2026-1989",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1989/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1989/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1989/index.md",
 "title": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) PHP Object Injection via Store Registration Data",
 "description": "The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to PHP Object Injection via the store phone field of store registration in versions 5.0.0 through 5.0.20, due to deserialization of untrusted input with maybe_unserialize() in StoreUtil::get_phone(). Any logged-in user can register a store. A serialized string supplied as the phone number is stored by update_meta() and decoded again when the store's phone is displayed. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "dc-woocommerce-multi-vendor",
  "name": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions",
  "full_name": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions",
  "wordpress_org": "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/dc-woocommerce-multi-vendor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.0.0",
    "from_inclusive": true,
    "to": "5.0.21",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.0.0 before 5.0.21"
  ]
 },
 "introduced_in": "5.0.0",
 "fixed_in": "5.0.21",
 "remediation": "Update to 5.0.21 or later.",
 "fix_released": "2026-10-29T01:22:54+00:00",
 "published": "2026-10-30T01:42:45+00:00",
 "updated": "2026-10-29T17:44:28.205240+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1989/",
  "https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.21/",
  "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}