CVE-2026-16746

Received Received - Intake

Unauthorized Financial Data Exposure in MultiVendorX WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-06

Assigner: WPScan

Description

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-06

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-16746

EUVD

EUVD-2026-53109

Affected Vendors & Products

Vendor	Product	Version / Range
multivendorx	plugin	to 5.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MultiVendorX WordPress plugin before version 5.0.11. It occurs in a REST API endpoint that handles commissions. The plugin fails to verify if the requested store belongs to the current user, allowing any vendor-level user to access other vendors' commission and financial data.

Detection Guidance

Check if the MultiVendorX plugin version is below 5.0.11. Use WordPress admin dashboard or run a command like 'wp plugin list' if using WP-CLI to verify the installed version.

Impact Analysis

If you are a vendor using the MultiVendorX plugin before version 5.0.11, an attacker with vendor-level access could exploit this flaw to view sensitive financial data, including commissions and earnings of other vendors on the same platform.

Compliance Impact

This vulnerability could lead to unauthorized access to financial data, potentially violating GDPR if personal data is exposed, or HIPAA if health-related financial data is involved. Compliance may be impacted due to unauthorized data disclosure.

Mitigation Strategies

Update the MultiVendorX plugin to version 5.0.11 or later immediately to patch the IDOR flaw. Remove vendor-level user access if not required.

Hi! I’m here to help you understand CVE-2026-16746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70