The vulnerability arises from a missing authorization check in the MultiVendorX plugin for WordPress, allowing attackers to exploit incorrectly configured access control security levels. Because the flaw lacks appropriate authorization checks, users can access or manipulate data that should be restricted, such as vendor or order information. This improper authorization can lead to data disclosure or unauthorized changes within the multi‑vendor environment.

The flaw affects the MultiVendorX plugin for WordPress, versions 5.0.20 and earlier. Users running any of these versions are at risk until they upgrade to a fixed release or apply an appropriate workaround.

With a CVSS score of 6.5 the vulnerability is moderate and could be exploited by attackers who submit crafted requests to the plugin’s endpoints. The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a direct HTTP request to the plugin’s protected functions. No public exploit is indicated, however a determined attacker could leverage the flaw to gain unauthorized access or modify data.