What the vulnerability does
01Description
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a canned email to the site's administrator asking to delete the profile of an arbitrary vendor.
Explanation of Vulnerability in Simple Terms
02Summary
MultiVendorX versions up to 4.2.4 contain an improper access control vulnerability that allows authenticated users to modify data they should not have permission to change. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 4.2.4 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify data or settings they lack authorization to change.
Potential impact on your site
04Site Impact
Authenticated users can alter marketplace data or settings beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site.
Key dates
06Disclosure timeline
October 24, 2024
CVE published
April 8, 2026
Record updated
