CVE-2026-127211: MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route
MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the MultiVendorX vendor/store_owner role can exploit it. The issue arises because that role has the edit_stores capability and the affected handlers do not verify ownership of the requested store.
What information could an attacker access?
A malicious vendor may retrieve data belonging to other stores, including contact email addresses, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics.
Is an unauthenticated attacker able to exploit this route?
No. The described attack requires authentication as a vendor; the available data does not indicate unauthenticated access.
Which deployments are affected?
MultiVendorX versions before 5.0.22 are affected. Deployments in which vendors can authenticate and use the stores REST route are exposed to the described cross-tenant data access.
How can administrators reduce exposure before updating?
The provided information identifies the affected REST route and vendor role but does not specify a supported workaround. Restricting or disabling vendor access to the affected functionality until the plugin is updated may reduce exposure, if operationally feasible.