CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect nonce validation on the submit_comment() function. This makes it possible for unauthenticated attackers to submit comments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
MultiVendorX versions before 3.5.8 lack CSRF protection on certain actions. An attacker can craft a malicious webpage that, when visited by a logged-in site admin or vendor, performs unwanted actions on their behalf—such as modifying settings or creating accounts. The victim must visit the attacker's page while logged into the marketplace.
What an attacker can do
Perform unauthorized actions (like changing settings or creating accounts) on behalf of a logged-in admin or vendor.
Potential impact on your site
Admins or vendors could have their accounts used to make unwanted changes without their knowledge or consent.
Conditions required to exploit
Victim must be logged into MultiVendorX and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
