{"id":"CVE-2026-74925","aliases":["EUVD-2026-75964","GHSA-w9pm-mr7j-6qjf"],"status":"published","title":"MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator","description":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00462,"percentile":0.40477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-09-11T06:00:07Z","modified":"2026-09-11T17:35:21Z","products":[{"vendor":"multivendorx","product":"multivendorx"},{"vendor":"unknown","product":"multivendorx"}],"references":[{"url":"https://wpscan.com/vulnerability/04d64797-751a-4cdd-a37d-70afbad5d784/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74925"},{"url":"https://wpscan.com/vulnerability/04d64797-751a-4cdd-a37d-70afbad5d784"},{"url":"https://github.com/advisories/GHSA-w9pm-mr7j-6qjf"}],"sources":{"cve":[{"id":"CVE-2026-74925","title":"MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator","description":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.","status":"published","published":"2026-09-11T06:00:07.43Z","modified":"2026-09-11T10:09:48.714Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:20:03.4818Z"}],"euvd":[{"id":"EUVD-2026-75964","description":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.","status":"published","published":"2026-09-11T06:00:07Z","modified":"2026-09-11T10:09:48Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-w9pm-mr7j-6qjf","title":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and...","description":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.","status":"published","published":"2026-09-11T09:31:22Z","modified":"2026-09-11T12:34:29Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:11:44.427999Z"}],"nvd":[{"id":"CVE-2026-74925","description":"The MultiVendorX  WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.","status":"published","published":"2026-09-11T07:16:46.74Z","modified":"2026-09-11T17:35:21.44Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:46.271848Z"}]}}