CVE-2026-16746: MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
Published Aug 5, 2026
·Updated
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
Affected Software
1 affected component
MultiVendorX WordPress plugin<5.0.11
Event History
Aug 5, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-16746?
The severity of CVE-2026-16746 is rated at 57, indicating a moderate risk level.
2
How do I fix CVE-2026-16746?
To fix CVE-2026-16746, upgrade the MultiVendorX WordPress plugin to version 5.0.11 or later.
3
What type of data is disclosed in CVE-2026-16746?
CVE-2026-16746 allows unauthorized access to other vendors' commission and financial data.
4
Who is affected by CVE-2026-16746?
Any vendor-level user of the MultiVendorX WordPress plugin before version 5.0.11 is affected by CVE-2026-16746.
5
How does CVE-2026-16746 occur?
CVE-2026-16746 occurs due to a lack of verification that the requested store belongs to the current user in the REST API endpoints.