CVE-2026-108695 | CVSS: 7.1 | 严重级别: HIGH
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.
参考链接:
• https://github.com/multivendorx/multivendorx
• https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a
• https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。