CVE-2026-74925

The MultiVendorX WordPress plugin prior to 5.0.16 does not restrict which users can modify the plugin's role and capability settings, an improper privilege management flaw (CWE-269). A user holding the plugin's vendor role can reach those unprotected settings and grant the vendor role administrator-level capabilities. The next time that vendor acts with their role, they effectively hold administrator rights and can take over the site, including full read/write control and content or configuration changes. Any WordPress site running a MultiVendorX version before 5.0.16 is affected, especially multi-vendor marketplaces where several untrusted parties hold vendor accounts. There is no public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

What to do: Update MultiVendorX to version 5.0.16 or later. If immediate upgrade is not possible, restrict and review who holds the vendor role and audit vendor accounts and role definitions for unexpectedly granted administrator-level capabilities, checking for any unauthorized admin users or capability changes.