CVE-2026-108695: MultiVendorX WordPress Plugin Auth Bypass

CVE-2026-108695 Overview

CVE-2026-108695 is an incorrect authorization vulnerability [CWE-863] in the MultiVendorX WordPress plugin through version 5.0.19. The plugin exposes a REST endpoint at /wp-json/multivendorx/v1/settings that is gated only by the edit_stores capability. Any authenticated user with the store_owner role can issue POST requests to overwrite marketplace-wide configuration including commission rates, payout rules, and onboarding settings. The flaw allows vendor accounts to modify integrity-sensitive settings that should be restricted to marketplace administrators.

Critical Impact

Vendor-level accounts can tamper with commission, payout, and onboarding configuration across the entire marketplace, enabling financial manipulation and operational disruption.

Affected Products

• MultiVendorX WordPress plugin versions through 5.0.19
• WordPress sites running the dc-woocommerce-multi-vendor plugin
• WooCommerce marketplaces that assign the store_owner role to vendors

Discovery Timeline

• 2026-10-11 - CVE-2026-108695 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108695

Vulnerability Analysis

The MultiVendorX plugin registers a REST API route for marketplace settings management. The permission callback for this route checks only the edit_stores capability, which is granted to the store_owner role by default. This role is intended for individual vendors who manage their own storefronts, not for marketplace-wide administration. Because the settings controller does not distinguish between vendor-scoped and global configuration, any store owner can submit a POST request to overwrite commission structures, payout schedules, and onboarding workflows. The result is a horizontal and vertical authorization failure that lets vendors modify data belonging to the marketplace operator and other vendors.

Root Cause

The root cause is a mismatch between the capability check and the sensitivity of the resource. The settings controller treats edit_stores as sufficient authorization for all marketplace configuration operations, violating the principle of least privilege. See the controller logic referenced in the GitHub Code Snippet - Settings and the update handler at lines 157-172.

Attack Vector

An attacker first obtains or registers a store_owner account on a target MultiVendorX marketplace. Vendor registration is typically open on commerce sites, lowering the barrier to exploitation. The attacker then sends an authenticated POST request to /wp-json/multivendorx/v1/settings with a crafted JSON body that overwrites commission percentages, payout destinations, or onboarding flags. No user interaction from administrators is required. Full technical details are documented in the VulnCheck Advisory on MultivendorX and GitHub Issue #2375.

// No verified proof-of-concept code is available.
// Refer to the VulnCheck advisory and GitHub issue linked above
// for technical reproduction details.

Detection Methods for CVE-2026-108695

Indicators of Compromise

• POST requests to /wp-json/multivendorx/v1/settings originating from accounts holding the store_owner role rather than administrators.
• Unexpected modifications to commission, payout, or onboarding configuration recorded in WordPress option tables.
• Audit log entries showing REST authentication from vendor accounts immediately followed by marketplace configuration changes.

Detection Strategies

• Enable WordPress REST API request logging and alert when non-administrator users invoke the MultiVendorX settings endpoint.
• Compare current marketplace settings against a known-good baseline on a scheduled interval to identify drift.
• Review database write events on the wp_options table for keys owned by the MultiVendorX plugin.

Monitoring Recommendations

• Forward WordPress and web server access logs to a centralized analytics platform for correlation across vendor accounts.
• Track newly registered store_owner accounts and flag any that make REST calls to administrative endpoints within a short window.
• Monitor outbound payout destinations for changes that could indicate financial redirection.

How to Mitigate CVE-2026-108695

Immediate Actions Required

• Audit all accounts holding the store_owner role and remove unused or suspicious vendor accounts.
• Review current MultiVendorX settings, including commission and payout configuration, against a trusted baseline and restore any unauthorized changes.
• Restrict vendor self-registration on the marketplace until a patched release is available.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the MultiVendorX GitHub Project Repository and the WordPress Plugin Listing for releases beyond 5.0.19 that address the authorization check in the settings REST controller.

Workarounds

• Deploy a web application firewall rule that blocks POST requests to /wp-json/multivendorx/v1/settings from any user not holding the manage_options capability.
• Use a WordPress role editor to remove the edit_stores capability from the store_owner role until the plugin is patched, accepting the trade-off of reduced vendor functionality.
• Disable the MultiVendorX plugin on production sites if marketplace operations can be temporarily suspended.

# Example: block the vulnerable endpoint for non-admin users via a WAF rule
# (adjust syntax for your WAF or reverse proxy)
if ($request_method = POST) {
    location = /wp-json/multivendorx/v1/settings {
        # Allow only requests carrying an administrator session cookie
        # or deny by default and whitelist admin source IPs
        deny all;
    }
}