MultiVendorX <= 5.0.18 - Authenticated (Subscriber+) Missing Authorization to Marketplace-Wide WooCommerce REST API Access
- ID
- WPSEC-2026-0115
- Plugin
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (dc-woocommerce-multi-vendor)
- Affected
- from 5.0.0 before 5.0.19
- Remediation
- Update to 5.0.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- MultiVendorX on WPSec AttackSurface
- Fix released
- Published
Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to unauthorized access in versions 5.0.0 through 5.0.18 due to the grant_woocommerce_rest_permission function, hooked to woocommerce_rest_check_permissions, granting WooCommerce REST API permission for every object and operation to any user listed as a member of their active store. Because the plugin grants the create_stores capability to every logged-in user, and its store registration REST endpoint makes the registering user the store's owner and active store regardless of approval, this makes it possible for authenticated attackers, with subscriber-level access and above, to read, modify and delete all orders, products and coupons on the marketplace, read customer data and change the email address and password of customer and subscriber accounts, and modify WooCommerce and payment gateway settings.
References
- https://wpsec.com/vuln/WPSEC-2026-0115/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.19/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS