high7.2
CVE-2026-16605
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an auth…
Impact
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
Affected products
| Product | Affected versions |
|---|---|
| MultiVendorX WordPress Plugin | before 5.0.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.