A missing authorization vulnerability in the MultiVendorX WordPress plugin allows authenticated vendors to compromise the data and stores of other marketplace participants.

The plugin fails to perform proper authorization checks within its REST API. This allows an authenticated attacker, specifically a user with Store Owner privileges or higher, to access, modify, or delete the stores of other vendors.

With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of multi-vendor marketplace data. An attacker could perform unauthorized store takeovers or deletions, leading to severe reputational damage and operational disruption. The vulnerability is exploitable over the network without requiring user interaction beyond the initial authentication.

Immediate Action: Update the MultiVendorX plugin to version 5.0.11 or later immediately to resolve the missing authorization flaw.

Proactive Monitoring: Audit WordPress REST API logs for suspicious access patterns or unauthorized modifications to store settings.

Compensating Controls: Implement strict role-based access control and restrict access to the WordPress REST API for untrusted or suspicious accounts until the patch is applied.

Public Exploit Available: Unknown

This vulnerability is highly actionable and poses a direct threat to marketplace data integrity. Administrators should verify their current version and apply the 5.0.11 update immediately to ensure that vendor authorization boundaries are properly enforced.