CVE-2026-16746CWE-639

CVE-2026-16746

Low · published August 5, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-05T11:16Z
References (1)
https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd/ · [email protected]
EPSS history
Timeline
  • 05 AUG 06:00Z
    MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
    cvelistv5