5.3
Moyenne
CVE-2026-74927 The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API…
Description
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MultiVendorX 5.0 | 5.0.13 → < 5.0.15 | 5.0.15 |
Autres CVE de MultiVendorX
Les 5 CVE de MultiVendorX →
CVE-2026-74926
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of…
7.1
Élevée
CVE-2026-74925
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings,…
7.2
Élevée
CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in…
2.7
Faible
CVE-2026-16605
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to…
7.2
Élevée