CVE-2026-16746 — MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

CVE-2026-16746

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint PUBLISHED

Description (CNA)

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

Affected (CNA)

Vendor / product	Versions
Unknown / MultiVendorX	affected 0 before 5.0.11

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.