CVE-2026-12941
Received Received - Intake

SQL Injection in MultiVendorX WooCommerce Multivendor Marketplace

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: Wordfence

Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable by any authenticated subscriber-level user when the plugin's store approval setting is configured to automatically approve store owners (described as the default), as this allows any logged-in user to self-register as a store_owner via the public Stores REST endpoint, thereby obtaining the edit_stores capability required to reach the vulnerable transactions endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-12941
EUVD
EUVD-2026-44860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
multivendorx woocommerce_multivendor_marketplace_ai_powered_solutions to 5.0.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions WordPress plugin. It exists due to insufficient escaping of the 'order_by' parameter and lack of proper SQL query preparation in versions up to 5.0.9. Attackers with subscriber-level access can exploit it to inject malicious SQL queries and extract sensitive database information.

Executive Summary

This vulnerability is a SQL Injection flaw in the MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress. It exists due to insufficient escaping of the 'order_by' parameter and lack of proper SQL query preparation in versions up to 5.0.9. Attackers with subscriber-level access can exploit this to inject malicious SQL queries and extract sensitive database information.

Impact Analysis

If you use this plugin, attackers could steal sensitive data from your WordPress database, such as user credentials, personal information, or financial details. The attack requires only a subscriber-level account, which can be obtained by self-registering as a store owner if the plugin's default approval setting is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Impact Analysis

If you use this plugin, attackers could steal sensitive data from your WordPress database, such as user credentials, payment details, or other confidential information. The attack requires only subscriber-level access, which can be obtained by self-registering as a store owner if the plugin's approval setting is set to automatic.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA compliance requirements. Organizations may face legal penalties, reputational damage, and loss of customer trust if sensitive data is compromised through this flaw.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin versions up to 5.0.9. Check for suspicious SQL queries in logs or network traffic targeting the 'order_by' parameter in the transactions endpoint. Enable WordPress debugging to log database queries.

Mitigation Strategies

Immediately update the plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict subscriber-level users' access to sensitive endpoints and disable automatic store approval settings. Monitor database queries for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart