7.1
High
CVE-2026-74926 The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of…
Description
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MultiVendorX 5.0 | 5.0.0 → < 5.0.16 | 5.0.16 |
Other CVEs of MultiVendorX
The 5 CVEs of MultiVendorX →
CVE-2026-74925
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings,…
7.2
High
CVE-2026-74927
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API…
5.3
Medium
CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in…
2.7
Low
CVE-2026-16605
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to…
7.2
High