Vulnerability in Multivendorx

CVE-2026-16746

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

Affected products

  • Unknown Multivendorx — versions 0

References