CVE-2026-127211

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

CVE-2026-127211 MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

CVE-2026-127211: MultiVendorX MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the…

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the storeowner role possessing the editstores capability and missing...

PT-2026-146071

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store owner role possessing the edit stores capability and missing...