CVE-2026-127211
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
64/100
Published: 2026-11-12
Modified: 2026-11-12
First seen: 2026-11-12
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
None
VC:
High
VI:
None
VA:
None
Description
MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| MultiVendorX | MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | 0 < 5.0.22 |
References & Advisories (2)
third-party-advisory
release-notes
patch