CVE-2026-39794 in Multivendor Marketplace Plugin
Summary
by MITRE • 10/06/2026
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an unbroken access control flaw within the WooCommerce Multivendor Marketplace plugin, specifically affecting versions up to and including 1.6.3, represents a critical security deficiency in how the application handles authentication and authorization for its REST API endpoints. This issue stems from insufficient verification of user privileges when processing requests directed at specific administrative or vendor-management functions exposed through the WordPress REST API interface. In a properly secured environment, any operation that modifies store configurations, manages vendor accounts, or accesses sensitive marketplace data must require valid credentials and appropriate role-based permissions. However, in this vulnerable implementation, certain endpoints fail to enforce these checks adequately, allowing unauthenticated actors to interact with functionality intended only for authorized administrators or verified vendors. This architectural oversight effectively bypasses the standard security perimeter established by WordPress authentication mechanisms, creating a direct pathway for malicious exploitation without requiring prior login credentials.
From a technical perspective, this flaw aligns closely with CWE-284, which describes Improper Access Control, and more specifically relates to CWE-639 regarding Authorization Bypass Through User-Controlled Key if the exploit relies on manipulating identifiers within API requests. The REST API in WordPress serves as a powerful interface for programmatic interaction with site data, but it requires strict adherence to capability checks before executing state-changing operations. In this case, the plugin fails to validate whether the requester possesses the necessary capabilities defined by WordPress roles such as shop_manager or administrator. Consequently, an attacker can craft HTTP requests targeting these unprotected endpoints to perform actions that should be restricted. This includes potentially creating new vendor accounts with elevated privileges, modifying marketplace settings, or accessing proprietary business data associated with other vendors and administrators. The lack of server-side validation on the client-supplied parameters allows for privilege escalation scenarios where a low-privilege user or even an anonymous visitor can elevate their effective permissions within the application context.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation across WordPress ecosystems, which power a significant portion of e-commerce websites globally. WooCommerce Multivendor Marketplace facilitates multi-vendor operations, meaning that successful exploitation could lead to comprehensive compromise of the marketplace infrastructure. Attackers can use this access control failure to inject malicious vendor profiles, alter commission structures, or exfiltrate customer and transaction data stored within the WordPress database. Furthermore, because REST APIs are often integrated with third-party applications and mobile clients, the attack surface is expanded beyond simple web browser interactions. An adversary could automate attacks using scripts that rapidly probe for these unprotected endpoints, leading to large-scale compromises of vulnerable installations. The ability to manipulate vendor relationships also poses a significant business risk, potentially disrupting marketplace operations, causing financial loss through fraudulent transactions, or damaging brand reputation by exposing sensitive operational details to the public internet.
Mitigation strategies must prioritize immediate remediation and ongoing security hardening. The most effective solution is to upgrade the WooCommerce Multivendor Marketplace plugin to version 1.6.4 or later, where these access control checks have been corrected to properly enforce authentication requirements on all affected REST API endpoints. For sites unable to update immediately due to compatibility constraints with other plugins or custom code modifications, temporary mitigations should be implemented at the web server level. This includes configuring Web Application Firewalls (WAF) rules to block unauthorized POST requests to specific REST API paths associated with vendor management and marketplace settings. Additionally, administrators should review user roles and capabilities within WordPress to ensure that no unnecessary permissions are granted to subscriber or customer-level accounts. Regular security audits focusing on REST API exposure and adherence to OWASP API Security Top 10 guidelines will help prevent similar access control failures in the future. Monitoring server logs for unusual patterns of requests to these endpoints can also aid in early detection of exploitation attempts before significant damage occurs.