The supplier’s WooCommerce Multivendor Marketplace plugin contains a missing capability check in the delete_table_rate_shipping_row function, allowing anyone who can send a request to the site to delete shipping table rates. Removing these records alters the calculation of shipping costs, potentially leading to incorrect charges, refunds, or denied shipments. The vulnerability is a classic missing authorization flaw (CWE‑862).

Any installation of the MultiVendorX plugin on a WordPress site running version 4.2.19 or earlier is vulnerable. The flaw exists across all builds up to that release and affects any store that relies on custom table rates for shipping.

The CVSS score of 5.3 indicates moderate severity. The EPSS value of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Attacks would require unauthenticated access to the WordPress installation and the ability to trigger the delete_table_rate_shipping_row endpoint, which can be achieved by forming an HTTP request to the plugin’s handler. Once exploited, the attacker can erase multiple table entries, destabilizing shipping logic and causing financial or service disruptions.