Authentication Bypass in MultiVendorX Plugin Exposes Vendor Stores
CVE-2026-16605
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16605?
A security flaw in the MultiVendorX WordPress plugin allows authenticated vendors (Store Owners and above) to exploit the REST API functionality without verifying ownership. This oversight enables them to view, take control of, permanently delete, or alter any other vendor's store on the marketplace, posing significant risks to data integrity and privacy. The vulnerability exists in versions prior to 5.0.11, emphasizing the necessity for timely updates and rigorous security practices to protect vendor information.
Affected Version(s)
MultiVendorX 0 < 5.0.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.