MultiVendorX vendors can grant themselves administrator powers
MultiVendorX before 5.0.16 does not restrict updates to its role and capability settings. A user holding the plugin's Vendor role can assign administrator-level capabilities to that role and take over the site. The authoritative export does not identify the settings endpoint, action, or capability parameter.
- Component
- MultiVendorX
- Plugin slug
multivendorx- Affected
- 5.0.0 to < 5.0.16
- Safe version
5.0.16- Published
- Sep 11, 2026
This CVE was published Sep 11, 2026 and is one of 5 known issues for this plugin.
Update, patch or deactivate.
Update MultiVendorX to 5.0.16 or later. The authoritative export marks versions below 5.0.16 affected. The application-level fix must reserve role and capability changes for trusted administrators and prohibit lower roles from granting capabilities they do not already possess.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H