WordPress Plugin Vulnerabilities

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

Description

The plugin does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

Proof of Concept

Affects Plugins

Plugin icon
dc-woocommerce-multi-vendor
Fixed in 5.0.16

References

CVE
CVE-2026-74925

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Philipp Doblhofer
Submitter
Philipp Doblhofer
Submitter website
https://www.codeaware.at
Verified
Yes
WPVDB ID
04d64797-751a-4cdd-a37d-70afbad5d784

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2026-02-20
Title
Wholesale Suite < 2.2.7 - Authenticated (Shop Manager) Privilege Escalation
Published
2026-06-16
Title
Falang multilanguage for WordPress < 1.4.3 - Subscriber+ Privilege Escalation
Published
2026-08-25
Title
FluentCRM Pro < 3.1.13 - Authenticated (Editor+) Privilege Escalation
Published
2026-09-10
Title
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
Published
2026-06-01
Title
AI Chatbot & Workflow Automation by AIWU < 1.4.19 - Unauthenticated Privilege Escalation