The MultiVendorX plugin for WooCommerce suffers from a missing authorization (CWE-862) vulnerability in the update_item_permissions_check and create_item_permissions_check functions. This flaw allows unauthenticated attackers to bypass capability checks, enabling privilege escalation and account takeover by modifying vendor user passwords, creating new vendor accounts, and demoting higher-privileged users such as administrators to vendor roles. The vulnerability affects all versions up to and including 4.2.0 and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation permits unauthenticated attackers to fully compromise vendor accounts by changing passwords, create new vendor accounts without authorization, and reduce administrator privileges to vendor level. This leads to complete account takeover and potential disruption or manipulation of the multivendor marketplace environment, severely impacting confidentiality, integrity, and availability of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid using vulnerable versions of MultiVendorX and consider disabling the plugin if possible. Follow vendor updates closely for an official patch or temporary mitigation.