CVE-2026-16605

CVE-2026-16605 affects the MultiVendorX WordPress plugin prior to version 5.0.11. The vulnerability arises from missing verification that the REST API target store belongs to the requesting vendor, allowing an authenticated Store Owner or higher to view, take over, delete, or modify other vendors...

EUVD-2026-53106

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...