Executive brief
MultiVendorX is a WordPress plugin that enables multi-vendor e-commerce functionality on WooCommerce sites. An authorization flaw in its REST API allows any logged-in user—even those with minimal permissions like subscribers—to modify any store's details, payment settings, and ownership records, potentially enabling store hijacking and data theft.
Technical details
The vulnerability is a missing authorization check (CWE-862) in one of the plugin's REST API routes. An authenticated but unprivileged user (such as a subscriber) can send a crafted API request to modify store metadata, payout settings, and ownership associations for any store in the system, not just their own. The attack requires only a valid WordPress user account; no additional authentication or user interaction is needed. An attacker can fully take over a store by changing its owner field and financial settings. The vulnerability was fixed in version 5.0.16; all versions 5.0.0 through 5.0.15 are affected.
Affected products
- MultiVendorX dc-woocommerce-multi-vendor 5.0.0 to 5.0.15
Timeline
- 2026-09-14: disclosed
- 2026-09-16: advisory
- 2026-09-16: patched: Fixed in version 5.0.16