Medium severity4.3NVD Advisory· Published Oct 24, 2024· Updated Jun 17, 2026
CVE-2024-9531
CVE-2024-9531
Description
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a canned email to the site's administrator asking to delete the profile of an arbitrary vendor.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<=4.2.4+ 1 more
- (no CPE)range: <=4.2.4
- (no CPE)
- wcmp/MultiVendorX – WooCommerce Multivendor Marketplace Solutionsv5Range: 0
Patches
Vulnerability mechanics
References
3- www.wordfence.com/threat-intel/vulnerabilities/id/5af1063c-615e-4196-9fa6-960c008544c4nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.phpnvdProduct
- plugins.trac.wordpress.org/changeset/3173238/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.phpnvdProduct
News mentions
0No linked articles in our index yet.