What the vulnerability does
01Description
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_item_permissions_check functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role.
Explanation of Vulnerability in Simple Terms
02Summary
MultiVendorX versions up to 4.2.0 lack proper authorization checks, allowing unauthenticated attackers to perform sensitive actions without permission. An attacker can read, modify, or delete data and functionality across the marketplace without needing to log in or interact with a user. This affects all confidentiality, integrity, and availability of the platform.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete marketplace data and functionality without authentication.
Potential impact on your site
04Site Impact
Attackers can compromise vendor and customer data, alter transactions, and disrupt marketplace operations without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 4, 2024
CVE published
April 8, 2026
Record updated
