This vulnerability in MultiVendorX WC Marketplace is classified as CWE-862, indicating missing authorization controls. It affects all versions up to 4.0.25, allowing unauthenticated attackers to access or modify resources without proper permission checks. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts including low confidentiality, high integrity, and low availability. No vendor advisory or patch information is currently available.

The vulnerability can lead to unauthorized actions within the affected WC Marketplace plugin, potentially compromising data integrity significantly and causing limited confidentiality and availability impacts. Since no known exploits are reported, the immediate risk may be limited, but the high CVSS score indicates a serious security concern if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider restricting access to the affected plugin functionalities where possible.