CVE-2026-16605

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

CVE-2026-16605 MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor Store Owner and above to view, take over, permanently delete, or modify any other vendor's store on the marketplace...

CVE-2026-16605

Summary: CVE-2026-16605 affects the MultiVendorX WordPress plugin (prior to 5.0.11). The issue is that the REST API does not verify that the targeted store belongs to the requesting vendor, enabling an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify ...

EUVD-2026-44670

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests...

CVE-2026-61736

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORSORIGINS= combined with allowcredentials=True in lightrag/api/lightragserver.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin request...

Shopify: Store Deletion or Sell without authentication

In order for an owner to "close or sell" the store, a password is required in order to confirm the decision, when the action is applied in the web application. It was identified that the mobile application doesn't require credentials in order to perform the same action, thus by navigating to the...

FAQ: Can the Store Name be Renamed on StoreFront?

Q: Can the store name be renamed on StoreFront? A : Renaming the StoreFront Store name is not supported. To workaround this issue create a new Store. Note : It is also not recommended to delete the Default Store.There have been issues reported with authentication when the default store is deleted...