CVE-2024-8289: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all versions up to, and including, 4.2.0. This makes it possible for unauthenticated attackers to change the password of any user with the vendor role, create new users with the vendor role, and demote other users like administrators to the vendor role.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8289?
CVE-2024-8289 has been classified as a high severity vulnerability that allows for privilege escalation and account takeover.
How do I fix CVE-2024-8289?
To fix CVE-2024-8289, update the MultiVendorX plugin to version 4.2.1 or later where the vulnerability has been patched.
What are the potential impacts of CVE-2024-8289?
The potential impacts of CVE-2024-8289 include unauthorized access to user accounts and administrative functions within the MultiVendorX plugin.
Which versions of MultiVendorX are affected by CVE-2024-8289?
CVE-2024-8289 affects all versions of MultiVendorX up to version 4.2.1.
Who is vulnerable to CVE-2024-8289?
Any WordPress site using the MultiVendorX plugin versions prior to 4.2.1 is vulnerable to CVE-2024-8289.