CVE-2026-74927

MediumCVSS 5.3

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The MultiVendorX WordPress plugin before version 5.0.15 does not have proper authorisation controls on one of its REST API listing routes. This allows unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

Risk Assessment

The risk includes disclosure of sensitive financial and administrative vendor data, which could lead to identity theft, fraud, or breach of trust.

Recommendation

Update the MultiVendorX plugin to version 5.0.15 or later, which adds proper authorization controls on REST API routes.

Other vulnerabilities in MultiVendorX WordPress Plugin

CVE-2026-108695High
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

Original NVD description (English source)

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS