CVE-2026-108695: MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by editstores, to overwrite commission, payout, and onboarding settings.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An attacker needs a vendor account with the store_owner role. The vulnerable settings endpoint authorizes requests using only the edit_stores capability.
What access and request are required to make changes?
The attacker must be authenticated as a store_owner and able to send a POST request to /wp-json/multivendorx/v1/settings. No user interaction is required.
What settings can be changed through the vulnerable endpoint?
A successful attacker can overwrite marketplace-wide commission, payout, and onboarding settings.
Which versions are affected?
MultiVendorX WordPress plugin versions through 5.0.19 are affected.