CVE-2026-108695 in MultiVendorX Plugin
Summary
by MITRE • 10/11/2026
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The MultiVendorX WordPress plugin, specifically through version 5.0.19, suffers from a critical broken access control vulnerability that permits unauthorized modification of marketplace-wide configuration parameters. This flaw stems from an insufficient authorization check within the REST API endpoint responsible for handling general site settings. While the application correctly restricts certain administrative actions to users with high-level privileges such as administrator or shop_manager roles capable of managing global configurations, it erroneously relies on a lower-privilege capability known as edit_stores. This permission is typically granted to vendor accounts who are intended only to manage their own individual store listings and product data, not the overarching marketplace infrastructure. Consequently, any user authenticated with the store_owner role can exploit this misconfiguration to bypass security boundaries that should strictly separate per-store operations from global administrative functions.
The technical mechanism of exploitation involves sending crafted POST requests directly to the /wp-json/multivendorx/v1/settings endpoint. Because the server-side validation fails to verify whether the requesting user possesses the necessary elevated privileges for modifying system-wide settings, it accepts and processes these inputs without objection. An attacker can manipulate critical configuration fields including commission rates which determine how much revenue the platform retains from sales; payout schedules and methods that dictate when and how vendors receive their earnings; and onboarding parameters that control new vendor registration workflows. By overwriting these values, an adversary gains significant influence over the financial logic and operational policies of the entire marketplace environment, effectively elevating their privileges beyond what was intended by the application architecture.
The operational impact of this vulnerability is severe due to its direct effect on revenue generation and platform integrity. Malicious vendors can alter commission structures to divert funds away from the site owner or manipulate payout settings to delay or redirect payments to accounts they control. Furthermore, changing onboarding settings could allow an attacker to bypass verification processes, enabling fraudulent entities to join the marketplace without proper scrutiny. This level of access undermines trust among legitimate merchants and poses a substantial financial risk to platform operators. From a threat modeling perspective, this scenario aligns with CWE-269 Improper Privilege Management, as it involves a user acting outside their designated permissions due to flawed authorization logic. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker leverages legitimate credentials that have been misconfigured or exploited to gain unauthorized access to sensitive resources and perform administrative actions typically reserved for higher-privileged roles.
Mitigation strategies must prioritize immediate patching of the MultiVendorX plugin to a version later than 5.0.19 where this authorization check has likely been corrected by the developers. In environments where updating is not immediately feasible, administrators should implement strict input validation and additional server-side role verification for all requests targeting the settings REST endpoint. It is advisable to restrict access to /wp-json/multivendorx/v1/settings exclusively to users holding capabilities that explicitly allow managing global site options rather than just store-specific edits. Additionally, enabling comprehensive logging of API calls can help detect anomalous patterns indicative of exploitation attempts, allowing for rapid incident response before significant financial or data integrity damage occurs. Regular security audits focusing on REST API endpoint permissions are essential to prevent similar privilege escalation vectors in future updates.