MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution, 3d4d61636f393040be8331a38a7470269886491d
- CVE, Research URL
- Home page URL
-
Security reports for MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution
- Published on
- Sep 12, 2023
- Research Description
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor] < 4.0.26 MultiVendorX <= 4.0.25 - Improper Authorization on REST Routes via 'save_settings_permission' The MultiVendorX plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on the 'save_settings_permission' function for the REST routes instantiated by the 'mvx_rest_routes_react_module' function versions up to, and including, 4.0.25. This makes it possible for unauthenticated attackers to create, update, and delete vendors, retrieve sensitive information, and modify plugin settings.
- Affected versions
-
max 4.0.26.
- Status
-
vulnerable