CVE-2026-74925

The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) contains a privilege escalation vulnerability because it fails to restrict who can update its role and capability settings . This allows users with the vendor role to grant that role administrator-level capabilities , potentially leading ...