Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MultiVendorX | MultiVendorX – WooCommerce Multivendor Marketplace Solutions | up to 4.2.0 | — | No fix listed | CNA |
- MultiVendorX – WooCommerce Multivendor Marketplace Solutions VendorMultiVendorX Affected up to 4.2.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:wordpress:*:* | before 4.2.1 | Vulnerable | MultiVendorX |
- cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:wordpress:*:* Versions before 4.2.1 Vulnerable ·MultiVendorX
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8289
- 2026-10-03 Alias added: GHSA-j558-547g-jpj8
References
Other 4
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L705
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L641
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.0/api/class-mvx-rest-vendors-controller.php#L382
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/api/class-mvx-rest-vendors-controller.php?rev=3145638
More Multivendorx vulnerabilities
- TI-2025-00410 Path traversal in MultiVendorX – WooCommerce Multivendor Marketplace Solutions CVSS 3.1CRITICAL 9.8
- TI-2025-30587 WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-20680 WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2025-02437 Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions CVSS 3.1MEDIUM 6.5
- TI-2025-30589 WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-04883 Cross-site scripting in MultiVendorX – WooCommerce Multivendor Marketplace Solutions CVSS 3.1MEDIUM 6.4
Sources
- CVE-2024-8289 · CVE Program
- CVE-2024-8289 · NVD
- FIRST EPSS
- GHSA-j558-547g-jpj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences