CVE-2025-2789: MultiVendorX Auth Bypass Vulnerability

CVE-2025-2789 Overview

CVE-2025-2789 affects the MultiVendorX plugin for WordPress, a multivendor marketplace extension for WooCommerce. The vulnerability stems from a missing capability check on the delete_table_rate_shipping_row function. All plugin versions up to and including 4.2.19 are affected. Unauthenticated attackers can invoke the function remotely and delete Table Rates used for shipping cost calculations. The flaw is classified as [CWE-862] Missing Authorization. Successful exploitation disrupts shipping configurations without requiring authentication or user interaction.

Critical Impact
Unauthenticated attackers can delete shipping Table Rate records, corrupting shipping cost calculations across affected WooCommerce marketplaces.

Affected Products

MultiVendorX plugin for WordPress, versions up to and including 4.2.19
WooCommerce stores using MultiVendorX table rate shipping
WordPress sites with the dc-woocommerce-multi-vendor package installed

Discovery Timeline

2025-04-05 - CVE-2025-2789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2789

Vulnerability Analysis

The MultiVendorX plugin exposes the delete_table_rate_shipping_row function through a WordPress AJAX or REST endpoint without validating the caller's capabilities. The function processes deletion requests based solely on the presence of expected parameters. Because no current_user_can() check or nonce verification gate protects the handler, any anonymous HTTP client can invoke it. The impact is limited to integrity and availability of shipping data — no direct code execution or data confidentiality loss occurs. Shipping cost miscalculation can cause financial loss and operational disruption for marketplace vendors.

Root Cause

The root cause is a missing authorization control in the plugin's table rate shipping handler. Source references at lines 78 and 211 of packages/mvx-tablerate/mvx-tablerate.php in tag 4.2.19 show the deletion logic executing without a capability check. WordPress plugins must gate privileged actions with current_user_can() and nonce validation via check_ajax_referer(). Neither guard is present on this endpoint.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request to the vulnerable endpoint referencing a valid Table Rate row identifier. The server processes the deletion without authenticating the requester. Automated enumeration of row identifiers allows an attacker to erase all configured shipping rates. No user interaction is required, and no valid credentials or session cookies must be supplied.

No public proof-of-concept exploit code has been published for this vulnerability. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2025-2789

Indicators of Compromise

Unexpected removal of Table Rate entries from the MultiVendorX shipping configuration
WooCommerce shipping cost anomalies reported by customers or vendors after April 2025
HTTP POST requests to admin-ajax.php referencing the delete_table_rate_shipping_row action from unauthenticated sessions
Access log entries showing anonymous requests targeting mvx-tablerate endpoints

Detection Strategies

Inspect WordPress access logs for requests to the plugin's AJAX action names without a valid authenticated session cookie
Compare current Table Rate database rows against known-good backups to detect unauthorized deletions
Alert on unusually high volumes of POST requests to admin-ajax.php originating from a single external IP address
Enable WordPress audit logging to record administrative data changes performed by anonymous or low-privilege actors

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized SIEM for correlation
Baseline normal shipping configuration change frequency and alert on deviations
Monitor the wp_mvx_shipping_table_rate (or equivalent) database table for DELETE operations outside administrative sessions
Track Wordfence or equivalent WAF telemetry for signatures matching CVE-2025-2789 exploitation attempts

How to Mitigate CVE-2025-2789

Immediate Actions Required

Update the MultiVendorX plugin to the version that resolves the missing capability check, published after 4.2.19
Take an immediate backup of the WooCommerce shipping configuration and MultiVendorX database tables
Review Table Rate shipping entries for unauthorized deletions and restore missing rows from backup
Restrict access to wp-admin/admin-ajax.php from untrusted networks where operationally feasible

Patch Information

Upgrade the MultiVendorX plugin to a release later than 4.2.19 where the vendor has added a capability check and nonce validation to the delete_table_rate_shipping_row handler. Consult the Wordfence Vulnerability Report for the fixed version details and the WordPress plugin repository for release notes.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking unauthenticated requests carrying the vulnerable action parameter
Temporarily disable the MultiVendorX plugin if patching is not immediately possible and shipping table rates are business-critical
Enforce authentication at the reverse proxy layer for admin-ajax.php where feasible
Rotate WooCommerce and WordPress administrator credentials after remediation and audit logs for prior abuse

bash

# Configuration example: block anonymous access to the vulnerable AJAX action at the WAF layer
# Nginx example - reject requests to admin-ajax.php referencing the vulnerable action without a valid session
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "delete_table_rate_shipping_row") {
        if ($cookie_wordpress_logged_in_ = "") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-upstream;
}