The vulnerability lies in the settings REST endpoint of the MultiVendorX WordPress plugin, where authorization is incorrectly enforced. The API checks only for the edit_stores capability, which vendor accounts with the store_owner role possess, allowing them to POST to /wp-json/multivendorx/v1/settings and overwrite critical commission, payout, and onboarding configurations. According to CWE‑863, this lack of proper authorization enables privilege escalation and can undermine the integrity of the marketplace's financial settings.

All installations of the MultiVendorX plugin running version 5.0.19 or earlier on WordPress sites are affected. The plugin, published under the multivendorx namespace, can be found in the WordPress plugin repository and its source code on GitHub. Users employing these versions should verify their plugin version and consult the advisory linked in the references.

The CVSS score of 7.1 classifies this issue as a high severity vulnerability. While EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the exploitation path is straightforward: an authenticated store_owner can craft a POST request to the exposed REST endpoint. Successful exploitation results in unauthorized changes to marketplace settings, which could lead to financial loss or operational disruption.