The MultiVendorX WooCommerce Multivendor Marketplace plugin suffers from a CSRF vulnerability due to improper or missing nonce validation in api/class-mvx-rest-controller.php. This allows attackers to perform unauthorized actions by leveraging the privileges of an authenticated site administrator who is tricked into submitting a malicious request. Affected versions include all up to and including 4.2.4. The vulnerability impacts confidentiality, integrity, and availability to a limited extent, as reflected by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). No patch or official fix has been documented in the provided data.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly perform actions such as modifying vendor account details, creating new vendor accounts, or deleting users. This can lead to unauthorized changes in the marketplace user base and potential disruption of service or data integrity. The impact is limited by the requirement that the attacker must trick an authenticated administrator into initiating the action (UI:R). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger requests to the affected plugin. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.