CVE-2026-108695

18th percentile - higher than 18% of all known CVEs

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

A vendor with the store_owner role can change critical marketplace settings such as commissions and payouts, potentially causing financial losses and platform disruption.

Update the MultiVendorX plugin to a version newer than 5.0.19 that properly verifies permissions on the settings endpoint, and review and revert any unauthorized marketplace setting changes.