CVE-2026-74926 — MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

CVE-2026-74926

MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint PUBLISHED

Description (CNA)

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

Affected (CNA)

Vendor / product	Versions
Unknown / MultiVendorX	affected 5.0.0 before 5.0.16

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/35ff7d7e-b3fe-4ae2-92cd-a122b8cdd97c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.