Incorrect Authorization Vulnerability in MultiVendorX WordPress Plugin
CVE-2026-108695

7.1HIGH

Key Information:

Vendor

WordPress
Status
Multivendorx
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108695?

The MultiVendorX WordPress plugin, up to version 5.0.19, is vulnerable to incorrect authorization issues, allowing attackers with a store_owner role to exploit the settings REST endpoint. By sending crafted POST requests to /wp-json/multivendorx/v1/settings, malicious actors can modify critical marketplace-wide settings, including commission, payout, and onboarding configurations. This vulnerability could lead to significant misconfigurations and unauthorized adjustments in marketplace operations.

Affected Version(s)

MultiVendorX 0 <= 5.0.19

References

https://github.com/multivendorx/multivendorx/issues/2375
issue-tracking
https://github.com/multivendorx/multivendorx
product
https://github.com/multivendorx/multivendorx/blob/8a71779...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.