VULNERABILITY INTELLIGENCE

CVE-2026-16746

CVSS score2.7 LOW

EPSS probability0.30%

CISA KEVNot currently listed

Published2026-08-05

Last modified2026-08-26

Description

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.