Description

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:17.253Z",
  "pubdate": "2026-09-02T06:17:17.253Z",
  "executiveSummary": "The MultiVendorX WordPress plugin prior to version 5.0.15 is susceptible to an Improper Authorization vulnerability within its REST API implementation. This security flaw allows unauthenticated remote attackers to access sensitive vendor-related data that should be restricted to authorized administrative users.\nThe vulnerability resides in a specific REST API listing route, which fails to implement mandatory access control checks. Consequently, an attacker can perform unauthorized read operations to retrieve private information, including vendor contact details, financial payout data, outstanding payout balances, and internal administrative notes appended to store applications.\nThis vulnerability poses a significant risk to data confidentiality, potentially leading to the exposure of Personally Identifiable Information (PII) and sensitive financial metrics. Because the API endpoint is publicly accessible, exploitation requires no authentication or special privileges, making it highly attractive for automated data scraping or targeted reconnaissance campaigns against store owners. Organizations utilizing affected versions of MultiVendorX are advised to upgrade immediately to version 5.0.15 or higher to enforce necessary authorization protocols.",
  "technicalDetails": "The vulnerability is rooted in an authentication bypass within the MultiVendorX REST API interface. Specifically, the plugin implements a custom REST API endpoint designed to list store application data, but it fails to invoke the necessary permission callback functions—typically defined via 'permission_callback' in the register_rest_route() function—to verify the identity and authorization level of the requesting entity.\nIn a secure configuration, REST API routes handling sensitive information must perform a capability check (e.g., current_user_can('manage_options')) to ensure the requester possesses the required privileges before the underlying handler function executes. In this instance, the API route lacks this check, permitting any unauthenticated HTTP request to trigger the data retrieval logic.\nThe attack flow begins when an external actor sends a GET request to the vulnerable REST API endpoint. Upon receiving the request, the WordPress REST API framework routes the call to the MultiVendorX handler. Because the endpoint does not validate session tokens or user roles, the application proceeds to query the database for vendor application records. The handler then serializes this internal data—including private contact information, payout schedules, pending financial disbursements, and internal store management notes—into a JSON response and returns it to the attacker.\nThis flaw effectively treats the REST API endpoint as public, exposing backend administrative metadata to the public web. The impact is categorized as an information disclosure vulnerability. By intercepting these API responses, an attacker gains visibility into the financial health of vendors and sensitive administrative communications, which can be leveraged for social engineering, financial fraud, or further exploitation of the WordPress site. The issue affects all MultiVendorX plugin versions released prior to 5.0.15. The vulnerability is network-exploitable, requiring only access to the target's REST API, which is a standard component of modern WordPress installations."
}