CVE-2026-66651: WordPress MultiVendorX plugin <= 5.0.19 - Broken Access Control vulnerability
Published Aug 18, 2026
·Updated
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.19.
Affected Software
1 affected component
MultiVendorX dc-woocommerce-multi-vendor<=5.0.19
Event History
Aug 18, 2026
CVE Published
via MITRE·01:59 PM
Data Sourced
via MITRE·01:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Any site running MultiVendorX version 5.0.14 or earlier is within the affected version range. The issue is network-reachable and requires no authentication or user interaction.
2
What does an attacker need to exploit this?
An attacker does not need an account, credentials, or victim interaction. The supplied vector indicates the vulnerable functionality can be reached over the network with low attack complexity.
3
What is the expected impact?
Successful exploitation can result in limited confidentiality and integrity impact. No availability impact is indicated by the provided severity vector.