Broken Access Control in MultiVendorX Plugin for WordPress

CVE-2026-127211

What is CVE-2026-127211?

The MultiVendorX plugin for WordPress prior to version 5.0.22 is susceptible to a broken access control vulnerability, specifically in the /wp-json/multivendorx/v1/stores REST route. This weakness enables authenticated vendors with the store_owner role to access administrative flag handlers, leading to unauthorised data retrieval. Attackers can exploit the insecure direct object reference within the handler to gain access to sensitive information such as contact emails of other stores, pending financial withdrawals, and analytics data, ultimately resulting in a serious breach of cross-tenant confidentiality.

References