The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
References
Configurations
History
04 Jun 2025, 22:26
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Multivendorx multivendorx
Multivendorx |
|
| CPE | cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.19/packages/mvx-tablerate/mvx-tablerate.php#L211 - Product | |
| References | () https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.19/packages/mvx-tablerate/mvx-tablerate.php#L78 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4eca37-066f-428c-a4f7-061ce06e1142?source=cve - Third Party Advisory |
05 Apr 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-05 06:15
Updated : 2025-06-04 22:26
NVD link : CVE-2025-2789
Mitre link : CVE-2025-2789
JSON object : View
Products Affected
multivendorx
- multivendorx
CWE
CWE-862
Missing Authorization