CVE-2025-2789: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletetablerateshippingrow function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2789?
CVE-2025-2789 has been classified as a high severity vulnerability due to the potential for unauthorized data loss.
How do I fix CVE-2025-2789?
To fix CVE-2025-2789, update the MultiVendorX plugin to version 4.2.20 or later, which includes the necessary capability checks.
What type of data is exposed in CVE-2025-2789?
CVE-2025-2789 could lead to unauthorized deletion of shipping rate configurations, impacting seller operations within the marketplace.
Which versions of MultiVendorX are affected by CVE-2025-2789?
CVE-2025-2789 affects all versions of MultiVendorX up to and including 4.2.19.
What function is responsible for the vulnerability in CVE-2025-2789?
The vulnerability in CVE-2025-2789 is caused by a missing capability check in the delete_table_rate_shipping_row function.