CVE-2026-74925

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

Affected

MultiVendorX

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.46% chance of exploitation in the next 30 days, 39th percentile

Published

2026-09-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/04d64797-751a-4cdd-a37d-70afbad5d784/

References

• CVE Record
• NVD entry