Unauthorized Financial Data Exposure in MultiVendorX WordPress Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MultiVendorX WordPress plugin before version 5.0.11. It occurs in a REST API endpoint that handles commissions. The plugin fails to verify if the requested store belongs to the current user, allowing any vendor-level user to access other vendors' commission and financial data.

Useful 0 Not Useful 0

Detection Guidance

Check if the MultiVendorX plugin version is below 5.0.11. Use WordPress admin dashboard or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you are a vendor using the MultiVendorX plugin before version 5.0.11, an attacker with vendor-level access could exploit this flaw to view sensitive financial data, including commissions and earnings of other vendors on the same platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to financial data, potentially violating GDPR if personal data is exposed, or HIPAA if health-related financial data is involved. Compliance may be impacted due to unauthorized data disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MultiVendorX plugin to version 5.0.11 or later immediately to patch the IDOR flaw. Remove vendor-level user access if not required.

Useful 0 Not Useful 0