What the vulnerability does
01Description
The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22.
Explanation of Vulnerability in Simple Terms
02Summary
MultiVendorX versions up to 4.2.22 contain an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. The vulnerability does not expose sensitive information or disrupt site availability, but could allow unauthorized changes to marketplace content or settings. Site owners should update to a version newer than 4.2.22.
What an attacker can do
03Attacker Capabilities
Modify marketplace data or settings beyond their assigned permission level.
Potential impact on your site
04Site Impact
Vendors or customers could alter marketplace listings, orders, or configuration they should not control.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., vendor or customer account).
Key dates
06Disclosure timeline
May 17, 2025
CVE published
April 8, 2026
Record updated
