WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

CVE-2026-74925

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

EUVD-2026-75964

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-74925

CVE-2026-74925 affects the MultiVendorX WordPress plugin versions 5.0.0 through 5.0.15 . The root cause is a missing permission check on the plugin's role and capability settings endpoint: any user holding the vendor (Store Owner+) role can modify those settings to grant that role administrator-l...

CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

PT-2026-89779

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-81792

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

EUVD-2026-72644

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

CVE-2026-81792

Unauthenticated privilege escalation in the WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX , affecting versions ≤ 6.1.4 . An attacker with no prior access (no credentials, no user interaction) can escalate privileges over the network with low complexity. The CVSS 3.1 sco...

CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

PT-2026-86989

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

CVE-2024-8289

CVE-2024-8289 CVE-2024-8289 https://vulners.com/cve/CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution...

CVE-2026-74927

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-74927 MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-74927

MultiVendorX WordPress plugin (versions 5.0.13–5.0.14 ) lacks proper authorization on its stores REST endpoint , enabling unauthenticated attackers to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. The issue is...

EUVD-2026-69835

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

WordPress MultiVendorX plugin 5.0.13-5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure vulnerability

Unauthenticated Vendor PII and Payout Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MultiVendorX versions 5.0.13-5.0.14...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...