low2.7
CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing…
Impact
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
Affected products
| Product | Affected versions |
|---|---|
| MultiVendorX WordPress Plugin | before 5.0.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.