MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Missing Authorization to Withdrawal Approval and Balance Bypass
- ID
- WPSEC-2026-0114
- Plugin
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (dc-woocommerce-multi-vendor)
- Affected
- from 5.0.0 before 5.0.19
- Remediation
- Update to 5.0.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- MultiVendorX on WPSec AttackSurface
- Fix released
- Published
Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.0.0 through 5.0.18 due to a missing capability check on the withdrawal approval and disbursement actions of the Transactions REST controller's update_item handler, and a missing balance check on withdrawal requests. This makes it possible for authenticated attackers, with store owner-level access, to approve or release payouts of their own store's balance without administrator approval and, when automatic withdrawals via Stripe Connect or PayPal Payouts are enabled, to request payouts exceeding their available balance.
References
- https://wpsec.com/vuln/WPSEC-2026-0114/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.19/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS