CVE-2024-8289 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: wcmp. 📦 **Product**: MultiVendorX – WooCommerce Multivendor Marketplace Solutions. 📅 **Affected**: Versions **4.2.0 and earlier**. ✅ **Safe**: Versions > 4.2.0.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🌐 **Network**: Remote (AV:N). 🔒 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely without login.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: YES. Public PoC available on GitHub (pashayogi/CVE-2024-8289). 🌍 **Wild Exploitation**: High risk due to low barrier to entry and public code.

Q: How to self-check? (Features/Scanning)

🔍 **Check Method**: Scan for MultiVendorX plugin version ≤ 4.2.0. 🛠️ **Tools**: Use WPScan or manual version check in WordPress admin. 📝 **Indicator**: Look for `class-mvx-rest-vendors-controller.php` in older codebases.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update MultiVendorX to version **> 4.2.0**. 📢 **Status**: Vendor (wcmp) has addressed the issue in newer releases. Check WordPress plugin repository for latest version.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: Patch IMMEDIATELY. CVSS 9.8 + Public PoC = High active threat. Do not delay. Protect your marketplace data now.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical flaw in MultiVendorX plugin (≤v4.2.0). Insufficient permission checks in REST API endpoints (`update_item_permissions_check`, `create_item_permissions_check`).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-862 (Missing Authorization). The plugin fails to verify if the user has the right permissions before allowing item updates or creations via the REST API.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: wcmp. 📦 **Product**: MultiVendorX – WooCommerce Multivendor Marketplace Solutions. 📅 **Affected**: Versions **4.2.0 and earlier**. ✅ **Safe**: Versions > 4.2.0.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: Unauthorized creation and modification of vendor items. 📊 **Impact**: High Confidentiality, Integrity, and Availability loss.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🌐 **Network**: Remote (AV:N). 🔒 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely without login.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: YES. Public PoC available on GitHub (pashayogi/CVE-2024-8289). 🌍 **Wild Exploitation**: High risk due to low barrier to entry and public code.

Q7How to self-check? (Features/Scanning)

🔍 **Check Method**: Scan for MultiVendorX plugin version ≤ 4.2.0. 🛠️ **Tools**: Use WPScan or manual version check in WordPress admin. 📝 **Indicator**: Look for `class-mvx-rest-vendors-controller.php` in older codebases.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update MultiVendorX to version **> 4.2.0**. 📢 **Status**: Vendor (wcmp) has addressed the issue in newer releases. Check WordPress plugin repository for latest version.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Disable the MultiVendorX plugin immediately if update is impossible. 🛑 **Mitigation**: Restrict REST API access via WAF or firewall rules targeting `/wp-json/mvx/` endpoints.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: Patch IMMEDIATELY. CVSS 9.8 + Public PoC = High active threat. Do not delay. Protect your marketplace data now.

Continue exploring

Vulnerability detail Full AI analysis (login) wcmp CWE-862