The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress contains an authorization bypass vulnerability (CWE-863) due to a misconfigured capability check in the 'delete_fpm_product' function. Authenticated users with Contributor-level privileges or above can exploit this flaw to delete arbitrary posts, pages, attachments, and products. The issue affects all versions up to and including 4.2.22. While version 4.2.22 includes a partial patch, the vulnerability is not fully resolved. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low complexity and requiring low privileges.

Exploitation of this vulnerability allows authenticated users with Contributor-level access or higher to delete arbitrary content within the WordPress site, including posts, pages, attachments, and products managed by the plugin. This results in unauthorized modification and loss of data integrity. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

A partial patch addressing this vulnerability was included in version 4.2.22 of the MultiVendorX plugin. Users should upgrade to version 4.2.22 or later to benefit from the partial fix. Since the patch is partial, users should monitor vendor advisories for further updates or complete fixes. No official patch link is currently provided, and patch status beyond version 4.2.22 is not confirmed. Until a full fix is available, restrict Contributor-level access to trusted users only to mitigate risk.