CVE-2026-74927: MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint
Published Sep 2, 2026
·Updated
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
Affected Software
1 affected component
MultiVendorX MultiVendorX WordPress plugin<5.0.15
Event History
Sep 2, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Which installations are affected?
MultiVendorX WordPress plugin versions before 5.0.15 are affected. Versions 5.0.13 and 5.0.14 are specifically identified.
2
Does exploitation require an account or elevated permissions?
No. The vulnerable REST API listing route can be accessed by unauthenticated users because it lacks proper authorization controls.
3
What information could be exposed?
An attacker could retrieve vendor contact and payout details, pending payout amounts, and administrative notes associated with store applications.