CVE-2026-66651: WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.
Affected Software
1 affected component
wordpress/MultiVendorX<=5.0.14
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/MultiVendorXto a version that resolves this vulnerability.Fixed in 5.0.14
Event History
Aug 18, 2026
CVE Published
via MITRE·01:59 PM
Data Sourced
via MITRE·01:59 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Any site running MultiVendorX version 5.0.14 or earlier is within the affected version range. The issue is network-reachable and requires no authentication or user interaction.
2
What does an attacker need to exploit this?
An attacker does not need an account, credentials, or victim interaction. The supplied vector indicates the vulnerable functionality can be reached over the network with low attack complexity.
3
What is the expected impact?
Successful exploitation can result in limited confidentiality and integrity impact. No availability impact is indicated by the provided severity vector.