The MultiVendorX plugin contains a flaw that allows a user with subscriber-level or higher privileges to supply an unvalidated value for the 'order_by' parameter in the transactions REST endpoint. The plugin concatenates this value directly into an SQL query, exposing a classic SQL Injection vulnerability identified as CWE-89. An attacker who succeeds can read sensitive data or modify database contents, compromising confidentiality and integrity.

All WordPress sites running the MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin version 5.0.9 or earlier are affected. The flaw is exploitable only when the plugin’s store approval setting is configured to automatically approve store owners, a default setting. In this configuration any logged‑in subscriber can self‑register as a store owner through the public Stores REST endpoint, thereby gaining the edit_stores capability required to reach the vulnerable endpoint.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score is below 1%, suggesting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated WordPress user who takes advantage of the automatic approval feature to elevate themselves to a store owner and then sends a crafted request to the vulnerable endpoint to extract or alter database information.