PT-2026-93275

CVE-2026-74926

Published

2026-09-16

Updated

2026-09-16

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions MultiVendorX WordPress plugin versions prior to 5.0.16

Description An issue exists where the plugin fails to verify store ownership within a REST API route. This allows any authenticated user, including those with subscriber privileges, to overwrite store details, modify payout settings, and change the ownership records of any store.

Recommendations Update the plugin to version 5.0.16 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Farid Narimanov

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers