The vulnerability arises from a misconfigured capability check on the delete_fpm_product function, allowing any authenticated user with Contributor permissions or higher to delete arbitrary posts, pages, attachments, and products. This results in unintended data loss and potential disruption of the marketplace’s content integrity. The weakness maps to CWE‑863, an improper authorization flaw that compromises the integrity of stored data. The impact is limited to data loss rather than system compromise, but it can undermine user trust and content consistency.

WordPress sites running the MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin in versions up to and including 4.2.22 are affected. The vendor identified as wcmp:MultiVendorX delivers the plugin, which integrates tightly with WooCommerce and operates as a standard WordPress plugin. Users of these plugin versions on any WordPress installation without the fixed capability check are vulnerable.

The CVSS score is 4.3, indicating a moderate risk level, while the EPSS score is below 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated and belong to the Contributor role or higher; the exploitation path involves invoking the delete_fpm_product function via the plugin’s AJAX endpoint or admin interface. Because the flaw is limited to content deletion, attackers can cause data loss and service disruption but cannot gain broader system control.