A critical authorization bypass vulnerability in the MultiVendorX plugin allows authenticated users to hijack store management and payout settings.

This is a missing authorization flaw (CWE-862) occurring within the plugin REST API. Any authenticated user, including those with minimal privileges such as subscribers, can perform unauthorized actions on store configurations.

The vulnerability poses a severe risk to marketplace integrity by allowing unauthorized modification of store details, payout settings, and ownership metadata. With a CVSS score of 7.1, this flaw enables malicious actors to redirect financial disbursements or seize control of vendor accounts, leading to significant financial loss and potential platform-wide reputational damage.

Immediate Action: Update the MultiVendorX plugin to version 5.0.16 or later immediately to enforce necessary ownership verification checks.

Proactive Monitoring: Audit WordPress REST API access logs for anomalous requests originating from low-privileged accounts targeting store configuration endpoints.

Compensating Controls: If patching is delayed, utilize a Web Application Firewall (WAF) to restrict access to sensitive REST API routes associated with the MultiVendorX plugin.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized financial redirection and account takeover, administrators must treat this as a high-priority update. Ensure the plugin is upgraded to version 5.0.16 immediately to close the authorization gap and prevent malicious manipulation of store data.