CVE Catalog
CVE-2026-66651
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
Broken Access Control vulnerability in MultiVendorX versions up to 5.0.14. The attack does not require authentication.
Risk Assessment
An unauthenticated attacker can gain unauthorized access to administrative functions, potentially leading to full control of the store or data theft.
Recommendation
Update the MultiVendorX plugin to the latest version that includes the fix.
Original NVD description (English source)
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.