CVE-2026-12941
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The MultiVendorX plugin for WordPress is vulnerable to generic SQL injection via the 'order_by' parameter in versions up to and including 5.0.9. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with subscriber-level access or higher to append additional SQL queries.
Risk Assessment
An attacker can extract sensitive information from the database, such as user passwords or customer data, leading to data breach and loss of trust.
Recommendation
Immediately update the MultiVendorX plugin to the latest available version that includes a fix for the SQL injection vulnerability.
Other vulnerabilities in MultiVendorX
See all- CVE-2026-74926High
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
- CVE-2026-74925High
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- CVE-2026-66651Medium
Missing Authorization vulnerability in MultiVendorX dc-woocommerce-multi-vendor allows exploiting incorrectly configured access control security levels. This issue affects MultiVendorX from n/a through 5.0.20.
- CVE-2026-66441High
Unauthenticated Broken Access Control vulnerability in MultiVendorX versions up to 5.0.10.
- CVE-2026-16746Low
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
- CVE-2026-16605High
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
Original NVD description (English source)
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable by any authenticated subscriber-level user when the plugin's store approval setting is configured to automatically approve store owners (described as the default), as this allows any logged-in user to self-register as a store_owner via the public Stores REST endpoint, thereby obtaining the edit_stores capability required to reach the vulnerable transactions endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS