CVE-2026-108695
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp
CVSS
7.1
Alta
EPSS
0.3%
p26
KEV
—
Exploit Today
8
0-100
Publicado: 11 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-863
0.3%EPSS · 30 dias0.3%
2026-10-112026-11-05
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
- github.comhttps://github.com/multivendorx/multivendorx
- github.comhttps://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172
- github.comhttps://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80
- github.comhttps://github.com/multivendorx/multivendorx/issues/2375
- wordpress.orghttps://wordpress.org/plugins/dc-woocommerce-multi-vendor/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/multivendorx-through-5.0.19-incorrect-authorization-via-settings-rest-endpoint
- github.comhttps://github.com/multivendorx/multivendorx/issues/2375
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1233343.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project9hCVE-2026-1233333.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints9hCVE-2026-1233286.4 MÉD—
———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab9hCVE-2026-1233267.1 ALT—
———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension9hCVE-2026-1233247.7 ALT—
———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible9hCVE-2026-1232993.1 BAI—
———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible9h