PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74925 MultiVendorX CVE debrief

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site. This vulnerability allows users with the vendor role to escalate their privileges, potentially leading to site takeover. Defenders should assess exposure and prioritize remediation for MultiVendorX WordPress plugin versions before 5.0.16, verifying vendor role permissions and restricting updates to role and capability settings.

Vendor
MultiVendorX
Product
MultiVendorX WordPress plugin
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders responsible for WordPress installations with the MultiVendorX plugin should assess exposure and prioritize remediation. This includes verifying vendor role permissions, restricting updates to role and capability settings, and monitoring for suspicious activity related to the MultiVendorX plugin.

Why it matters

CVE-2026-74925 allows users with vendor role to grant administrator-level capabilities, potentially leading to site takeover. Defenders should assess exposure and prioritize remediation for MultiVendorX WordPress plugin versions before 5.0.16.

  • Potential site takeover by users with vendor role
  • Elevation of privileges for users with vendor role
  • Possible unauthorized access to sensitive data
  • Required verification of vendor role permissions and remediation priority

Technical summary

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site. This vulnerability allows users with the vendor role to escalate their privileges, potentially leading to site takeover or unauthorized access to sensitive data.

Defensive priority

Assess exposure and prioritize remediation for MultiVendorX WordPress plugin versions before 5.0.16.

Recommended defensive actions

  • Assess exposure and prioritize remediation for MultiVendorX WordPress plugin versions before 5.0.16
  • Verify vendor role permissions and restrict updates to role and capability settings
  • Monitor for suspicious activity related to the MultiVendorX plugin

Evidence notes

The CVE description explicitly names the MultiVendorX WordPress plugin as the affected product. The NVD entry is currently Deferred. The vulnerability has been identified in the MultiVendorX WordPress plugin before version 5.0.16. Defenders should verify the affected scope and review context to understand potential operational impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.