CVE-2026-74926: MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit the affected REST API route, including users with only the Subscriber role. The attacker does not need to own the store they target.
What can an attacker change?
An attacker can overwrite another store's details and payout settings. They can also replace the recorded owner of the store.
Which versions need remediation?
MultiVendorX versions before 5.0.16 are affected. Updating to version 5.0.16 or later addresses the affected version range.
How can I assess whether exploitation may have occurred?
Review store records for unexpected changes to store details, payout settings, or the recorded store owner. Pay particular attention to changes associated with low-privileged authenticated accounts, such as subscribers.