CVE-2026-127211
MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route
MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.
| CWE | CWE-862 |
| Vendor | multivendorx |
| Product | multivendorx – woocommerce multivendor marketplace ai powered solutions |
| Published | Nov 12, 2026 |
Get instant alerts for multivendorx multivendorx – woocommerce multivendor marketplace ai powered solutions
Be the first to know when new medium vulnerabilities affecting multivendorx multivendorx – woocommerce multivendor marketplace ai powered solutions are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N