Is CVE-2026-108695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108695 being exploited in the wild.

How severe is CVE-2026-108695?

High severity, with a CVSS score of 7.1, published 11 October 2026.

Is there a fix for CVE-2026-108695?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108695 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108695?

Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108695: MultiVendorX WordPress plugin authorization bypass in settings endpoint

CVE-2026-108695 · Severity: high · CVSS 7.1 · Published 2026-10-11

MultiVendorX is a WordPress plugin that enables multi-vendor marketplace functionality. The plugin contains a flaw that allows vendor accounts to modify critical marketplace settings including commission rates and payout rules by sending requests directly to the settings API endpoint. An attacker with store_owner credentials can exploit this to change platform-wide configuration and potentially redirect payments or alter business rules.

Technologies: MultiVendorX. Vendors: MultiVendorX.

Quick answers

Is CVE-2026-108695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108695 being exploited in the wild.
How severe is CVE-2026-108695?: High severity, with a CVSS score of 7.1, published 11 October 2026.
Which products and versions are affected?: MultiVendorX through 5.0.19.
Is there a fix for CVE-2026-108695?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108695 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108695?: Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization check in the REST API settings controller (/wp-json/multivendorx/v1/settings) that only verifies the edit_stores capability rather than proper platform-level permissions. Vendor accounts with the store_owner role can POST to this endpoint to modify marketplace commission, payout, and onboarding settings. No special privileges, authentication bypass, or user interaction is required beyond having a vendor account; the attack is exploitable over the network via the REST API.

Affected products

MultiVendorX MultiVendorX through 5.0.19

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.