{"uuid": "9baf3210-6a13-4e0a-bf8a-8da211b16638", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108695", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419770852307785", "content": "CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108695https://github.com/multivendorx/multivendorx/issues/2375https://github.com/multivendorx/multivendorxhttps://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172https://wordpress.org/plugins/dc-woocommerce-multi-vendor/https://www.vulncheck.com/advisories/multivendorx-through-5.0.19-incorrect-authorization-via-settings-rest-endpoint#wordpress #multivendorx #MultiVendorX#CVE_2026_108695#bot", "creation_timestamp": "2026-10-11T01:51:55.725650Z"}