7.2
High
CVE-2026-16605 The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to…
Description
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MultiVendorX 5.0 | earliest → < 5.0.11 | 5.0.11 |
Other CVEs of MultiVendorX
The 5 CVEs of MultiVendorX →
CVE-2026-74926
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of…
7.1
High
CVE-2026-74925
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings,…
7.2
High
CVE-2026-74927
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API…
5.3
Medium
CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in…
2.7
Low