UNKNOWN NVD

CVE-2026-16746

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

References

https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd/

Published: 2026-08-05 · Source: NVD · Feed updated: 2026-08-05

This unknown severity vulnerability was published on 2026-08-05 via NVD.

vulnfeed aggregates 9225 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.