# MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) PHP Object Injection via Store Registration Data

- **ID:** WPSEC-2026-1989
- **Plugin:** MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (`dc-woocommerce-multi-vendor`), https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
- **Affected versions:** from 5.0.0 before 5.0.21
- **Fixed in:** 5.0.21 (Update to 5.0.21 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/dc-woocommerce-multi-vendor
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1989/

## Description

The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to PHP Object Injection via the store phone field of store registration in versions 5.0.0 through 5.0.20, due to deserialization of untrusted input with maybe_unserialize() in StoreUtil::get_phone(). Any logged-in user can register a store. A serialized string supplied as the phone number is stored by update_meta() and decoded again when the store's phone is displayed. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP object. No known POP chain is present in the vulnerable software itself. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1989/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.21/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1989/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.