WordPress MultiVendorX Privilege Escalation via REST API edit_stores capability

Vulnerability Overview Title: Vendor-to-admin privilege escalation via shared capability on global Settings/Modules REST endpoints (plugins/multivendorx) #2375 Description: Affected Versions: Current stable version 5.0.18 on WordPress.org (downloaded on 2026-09-30), as well as the branch of the repository at commit 545c7fd374374ac39bd7006066c840391574d25. Issue: The and REST endpoints in the MultiVendorX plugin utilize the capability for permission checks. This capability is unconditionally granted to all users with the role. Consequently, any vendor account can rewrite marketplace-wide commission settings, payment/distribution plans, global settings, and activate or deactivate platform modules. Impact Privilege Escalation: Any user holding the role (which can be assigned to any approved marketplace seller) can: - Override marketplace-wide commission structures, potentially reducing or eliminating sales commissions for sellers. - Override payment/distribution plans, affecting payment timing and amounts for all sellers. - Override other marketplace-wide configuration groups, such as registration and configuration groups. - Activate or deactivate any MultiVendorX platform module, independent of configurations by other vendors or administrators. Remediation Recommended Fix: Update the permission checks in and to require the capability instead of , aligning with the permission controls used for marketplace-wide setting groups. Specific Modifications: - In , require the capability. - In , require the capability. - For setting groups associated with the capability, retain those in the OR-logic list but ensure their handlers use checks similar to , mirroring the correctly implemented pattern found in and . POC Code Summary This vulnerability allows any user with the role to escalate privileges via the shared capability, enabling unauthorized modifications to marketplace-wide settings and modules. The remediation involves updating the permission checks to require the capability, ensuring that only administrators can perform these actions.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress MultiVendorX Privilege Escalation via REST API edit_stores capability

More from this source