Vulnerability identifier: #VU99923

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-9531

CWE-ID: CWE-285

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
MultiVendorX
Web applications / Modules and components for CMS

Vendor: WC Marketplace

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a missing capability check on the "mvx_sent_deactivation_request" function. A remote user can send a specially crafted email to the site's administrator asking to delete the profile of an arbitrary vendor.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

MultiVendorX: 4.2.0 - 4.2.4

---

External links
http://www.wordfence.com/threat-intel/vulnerabilities/id/5af1063c-615e-4196-9fa6-960c008544c4?source=cve
http://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php#L3780
http://plugins.trac.wordpress.org/changeset/3173238/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php?contextall=1&old=3168957&old_path=%2Fdc-woocommerce-multi-vendor%2Ftrunk%2Fclasses%2Fclass-mvx-ajax.php

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.