CVE-2026-16746 PUBLISHED

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

Assigner: WPScan
Reserved: 23.07.2026 Published: 05.08.2026 Updated: 05.08.2026

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

Product Status

Vendor Unknown
Product MultiVendorX
Versions Default: unaffected
  • affected from 0 to 5.0.11 (excl.)

Credits

  • ryan fabella finder
  • WPScan coordinator

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE