CVE-2026-108695
7.1 HIGHpublic exploit availablePublished 2026-10-11 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-863
Public exploit & PoC references
- https://github.com/multivendorx/multivendorx
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80
- https://github.com/multivendorx/multivendorx/issues/2375
- https://github.com/multivendorx/multivendorx/issues/2375
All references
- https://github.com/multivendorx/multivendorx
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172
- https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80
- https://github.com/multivendorx/multivendorx/issues/2375
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
- https://www.vulncheck.com/advisories/multivendorx-through-5.0.19-incorrect-authorization-via-settings-rest-endpoint
- https://github.com/multivendorx/multivendorx/issues/2375
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
- HIGHCVE-2026-100273
- MEDIUMCVE-2026-100276
- HIGHCVE-2026-100277
- MEDIUMCVE-2026-100278
Related by shared AI tags and CWE weakness class. Browse the full archive.