CVE-2026-16746
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
Risk Assessment
The vulnerability allows unauthorized access to sensitive financial data of other vendors, potentially leading to privacy breaches and fraud.
Recommendation
Update the plugin to version 5.0.11 or later and review REST API access logs for unauthorized attempts.
Original NVD description (English source)
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.