The MultiVendorX WooCommerce Multivendor Marketplace plugin versions up to and including 4.2.4 contain an improper authorization vulnerability (CWE-285) due to a missing capability check in the 'mvx_sent_deactivation_request' function. This flaw permits authenticated users with Subscriber-level privileges or higher to send a canned email to the site administrator requesting deletion of any vendor profile, enabling unauthorized modification of vendor data. The CVSS 3.1 base score is 4.3 (medium severity) with network attack vector, low attack complexity, and requiring low privileges without user interaction.

The vulnerability allows authenticated users with minimal privileges (Subscriber-level) to request deletion of arbitrary vendor profiles by sending a canned email to the site administrator. This could lead to unauthorized modification of vendor data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider limiting Subscriber-level access or implementing additional controls to prevent unauthorized use of the 'mvx_sent_deactivation_request' function. Monitoring for updates from the MultiVendorX plugin vendor is recommended.