Executive brief
The MultiVendorX WordPress plugin fails to properly verify user permissions on a REST API endpoint that lists vendor and store information. Unauthenticated attackers can access sensitive business data including vendor contact details, bank account information, payment processor addresses, payout amounts, administrative rejection notes, and vendor deactivation reasons without logging in.
Technical details
The MultiVendorX WordPress plugin contains a missing authorization vulnerability in its REST API `/wp-json/multivendorx/v1/stores` endpoint. The endpoint uses nonce validation to verify CSRF tokens but does not check user capabilities or authentication status; an unauthenticated attacker can obtain a public nonce from the Store Registration page and use it to retrieve sensitive data through query parameters (store_registration=1, pending_withdraw=1, deactivate=1). The vulnerability exposes vendor personally identifiable information (tax IDs, bank sort codes, phone numbers, PayPal addresses), payout amounts, administrative notes, and free-text deactivation reasons. The root cause is reliance on nonce validation alone without capability checks. A fix is available in version 5.0.15 and later.
Affected products
- MultiVendorX MultiVendorX before 5.0.15
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 5.0.15
- 2026-09-02: advisory