CVE-2026-127211

Received Received - Intake

Broken Access Control in MultiVendorX WordPress Plugin

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-127211

Affected Vendors & Products

Vendor	Product	Version / Range
MultiVendorX	MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions	From 0 (inc) to 5.0.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a broken access control issue in the MultiVendorX WordPress plugin before version 5.0.22. It allows authenticated vendors with the store_owner role to access administrative functions due to missing per-store ownership checks. Attackers can exploit insecure direct object references to access sensitive data from other stores.

Detection Guidance

Check if the MultiVendorX plugin is installed and verify its version. If it is below 5.0.22, the system is vulnerable. Inspect REST API endpoints for unauthorized access to /wp-json/multivendorx/v1/stores and related handlers like visitorMap.

Impact Analysis

If you are a vendor using this plugin, attackers could access your store's sensitive data such as contact emails, withdrawal amounts, onboarding details, and visitor analytics. This could lead to data breaches, financial loss, or reputational damage.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and loss of trust.

Mitigation Strategies

Update the MultiVendorX plugin to version 5.0.22 or later immediately. Review and restrict the edit_stores capability to ensure proper per-store ownership checks are enforced. Audit logs for unauthorized access to sensitive data via the REST API endpoints.

Hi! I’m here to help you understand CVE-2026-127211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...