CVE-2026-16605 — MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization

CVE-2026-16605

MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization PUBLISHED

Description (CNA)

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.

Affected (CNA)

Vendor / product	Versions
Unknown / MultiVendorX	affected 0 before 5.0.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad01737654a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.