CVE-2026-16605

7.2 HIGH

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows an authenticated vendor to manipulate other vendors' stores on the marketplace due to inadequate verification of store ownership.
Exploitability: Exploitation requires authentication as a vendor with Store Owner privileges and knowledge of target store details, making it moderately difficult.
Blast radius: If exploited, this could lead to significant data loss or unauthorized modifications across multiple vendor stores in the marketplace.
Prioritized remediation: Update MultiVendorX WordPress plugin to version 5.0.11 or later immediately.

auth-bypasswebwordpressmarketplace

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-862

All references

https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad01737654a/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.