MultiVendorX Incorrect Authorization via Settings REST Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
The MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization flaw in its settings REST endpoint, CWE-863. An attacker with the store_owner role can send POST requests to the settings endpoint, which is gated only by the edit_stores capability, to overwrite marketplace-wide commission, payout, and onboarding settings. The attack requires only low privileges over the network and no user interaction, and the impact is high integrity with low availability impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MultiVendorX | MultiVendorX | up to 5.0.19 | — | No fix listed | CNA |
- MultiVendorX VendorMultiVendorX Affected up to 5.0.19 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for MultiVendorX.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108695
- 2026-10-11 Alias added: GHSA-h37j-r28p-597w
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: LOW → MEDIUM
References
Other 5
- GitHub Issue #2375
- https://github.com/multivendorx/multivendorx
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
More MultiVendorX vulnerabilities
- TI-2023-28013 WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability CVSS 3.1HIGH 8.2
- TI-2025-00410 Path traversal in MultiVendorX – WooCommerce Multivendor Marketplace Solutions CVSS 3.1CRITICAL 9.8
- TI-2024-07685 Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions CVSS 3.1CRITICAL 9.8
- TI-2025-31831 WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability CVSS 3.1HIGH 8.6
- TI-2024-16234 WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerability CVSS 3.1HIGH 8.6
- TI-2026-47195 WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2026-108695 · CVE Program
- CVE-2026-108695 · NVD
- FIRST EPSS
- GHSA-h37j-r28p-597w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences