{"id":"CVE-2026-16605","published":"2026-08-05T07:16:36.217","lastModified":"2026-08-05T20:17:05.410","description":"The MultiVendorX  WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad01737654a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an authenticated vendor to manipulate other vendors' stores on the marketplace due to inadequate verification of store ownership.","exploitability":"Exploitation requires authentication as a vendor with Store Owner privileges and knowledge of target store details, making it moderately difficult.","blast_radius":"If exploited, this could lead to significant data loss or unauthorized modifications across multiple vendor stores in the marketplace.","remediation":"Update MultiVendorX WordPress plugin to version 5.0.11 or later immediately.","tags":["auth-bypass","web","wordpress","marketplace"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T07:02:29.452Z"}}