CVE-2026-74926
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Risk Assessment
Any authenticated user can modify any store's details and payout settings and take control of it. This leads to data integrity violations and potential financial losses.
Recommendation
Update the MultiVendorX plugin to version 5.0.16 or later. Review role and permission configuration and verify the integrity of store data.
Other vulnerabilities in MultiVendorX
See all- CVE-2026-74925High
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- CVE-2026-66651Medium
Broken Access Control vulnerability in MultiVendorX versions up to 5.0.14. The attack does not require authentication.
- CVE-2026-66441High
Unauthenticated Broken Access Control vulnerability in MultiVendorX versions up to 5.0.10.
- CVE-2026-16746Low
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
- CVE-2026-16605High
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
- CVE-2026-12941Medium
The MultiVendorX plugin for WordPress is vulnerable to generic SQL injection via the 'order_by' parameter in versions up to and including 5.0.9. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with subscriber-level access or higher to append additional SQL queries.
Original NVD description (English source)
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS