7.1
Élevée
CVE-2026-74926 The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of…
Description
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MultiVendorX 5.0 | 5.0.0 → < 5.0.16 | 5.0.16 |
Autres CVE de MultiVendorX
Les 5 CVE de MultiVendorX →
CVE-2026-74925
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings,…
7.2
Élevée
CVE-2026-74927
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API…
5.3
Moyenne
CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in…
2.7
Faible
CVE-2026-16605
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to…
7.2
Élevée