Unauthenticated Broken Access Control in MultiVendorX by Patchstack
CVE-2026-66651

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Multivendorx
Vendor
CVE Published:
18 August 2026

What is CVE-2026-66651?

The MultiVendorX plugin for WordPress contains a vulnerability that allows unauthenticated users to bypass access controls, potentially leading to unauthorized access and manipulation of user data. Versions up to and including 5.0.14 are affected, exposing systems to significant security risks. Website operators using this plugin should take immediate action to apply patches and secure their environments.

Affected Version(s)

MultiVendorX <= 5.0.14

References

https://patchstack.com/database/wordpress/plugin/dc-wooco...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman | Patchstack Bug Bounty Program
.