WordPress Plugin Vulnerabilities

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

Description

The plugin does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

Proof of Concept

Affects Plugins

Plugin icon
dc-woocommerce-multi-vendor
Fixed in 5.0.16

References

CVE
CVE-2026-74925

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Philipp Doblhofer
Submitter
Philipp Doblhofer
Submitter website
https://www.codeaware.at
Verified
Yes
WPVDB ID
04d64797-751a-4cdd-a37d-70afbad5d784

Timeline

Publicly Published
2026-09-09 (about 22 days ago)
Added
2026-09-09 (about 21 days ago)
Last Updated
2026-09-09 (about 21 days ago)

Other

Published
Title
Published
2025-09-23
Title
Goodlayers Core < 2.1.7 - Authenticated (Contributor+) Privilege Escalation
Published
2026-09-24
Title
Automation Web Platform < 4.8.7 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Published
2026-09-04
Title
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
Published
2025-04-30
Title
SureTriggers < 1.0.83 - Unauthenticated Privilege Escalation
Published
2026-08-31
Title
Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation