CVE-2026-74925
MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 11, 2026
- Updated
- Sep 11, 2026
- Reserved
- Aug 17, 2026
Description
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
MultiVendorXUnknown |
|
References
- https://wpscan.com/vulnerability/04d64797-751a-4cdd-a37d-70afbad5d784/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.