This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), affects the Product Catalog Enquiry for WooCommerce by MultiVendorX plugin in versions up to 6.1.4. It enables unauthenticated privilege escalation, meaning attackers without authentication can gain elevated privileges improperly. The CVSS v3.1 score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to escalate their privileges within the affected plugin, potentially leading to integrity and availability impacts. This could disrupt normal operations or allow unauthorized changes, but does not affect confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates and consider restricting access to the affected plugin where possible.