MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify… (CVE-2026-108695)

CVE-2026-108695 describes an incorrect authorization vulnerability in the MultiVendorX WordPress plugin through version 5.0.19. The vulnerability allows attackers with the store_owner role, which normally has limited permissions, to send POST requests to the /wp-json/multivendorx/v1/settings REST endpoint. This endpoint is only gated by the edit_stores capability, which the store_owner role possesses, enabling them to overwrite critical marketplace-wide settings such as commission rates, payout configurations, and onboarding parameters. The issue arises from insufficient authorization checks on this REST endpoint, leading to privilege escalation within the plugin's configuration management.

An attacker with the store_owner role can modify marketplace-wide settings, potentially disrupting commission structures, payout processes, and onboarding workflows. This could lead to financial manipulation or operational disruption of the marketplace. The vulnerability does not impact confidentiality but has high integrity impact and low availability impact according to the CVSS score.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict store_owner role permissions where possible and monitor for unauthorized configuration changes.