CVE-2026-74926
MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint
HIGH 7.1EPSS 0.3%
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
- Affected
- MultiVendorX
- CVSS v3.1 CNA
- 7.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - EPSS
- 0.34% chance of exploitation in the next 30 days, 26th percentile
- Published
- 2026-09-16
- Updated
- 2026-09-17