This vulnerability (CWE-862) in MultiVendorX Product Catalog Enquiry for WooCommerce arises from missing authorization controls, enabling unauthenticated users to potentially interact with the product catalog enquiry functionality without proper permissions. It affects all versions up to 5.0.5. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No patch or official remediation level has been published by the vendor as of the data available.

The impact includes potential unauthorized modification or disruption of the product catalog enquiry functionality, leading to low integrity and availability impacts. Confidentiality is not affected. Since no privileges or user interaction are required, the vulnerability could be exploited remotely over the network. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's functionality or disabling it if feasible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.