CyberRota Analysis
AI-GeneratedThe MultiVendorX WordPress plugin prior to version 5.0.16 is vulnerable as it fails to verify user ownership of stores in its REST API, allowing any authenticated user to modify store details and payout settings. This could lead to unauthorized access and manipulation of sensitive store information, posing significant risks to store owners and their customers. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.