WordPress Plugin Vulnerabilities

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

Description

The plugin does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

Proof of Concept

Affects Plugins

Plugin icon
dc-woocommerce-multi-vendor
Fixed in 5.0.11

References

CVE
CVE-2026-16746

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
ryan fabella
Submitter
ryan fabella
Verified
Yes
WPVDB ID
721033a0-b0bb-4a64-a99a-12ac416b20fd

Timeline

Publicly Published
2026-07-27 (about 9 days ago)
Added
2026-07-27 (about 8 days ago)
Last Updated
2026-07-27 (about 8 days ago)

Other

Published
Title
Published
2024-11-20
Title
Button Block – Get fully customizable & multi-functional buttons < 1.1.5 - Authenticated (Contributor+) Post Disclosure
Published
2026-08-03
Title
Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
Published
2026-07-08
Title
Easy Appointments <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification via IDOR
Published
2026-07-13
Title
FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes
Published
2025-11-12
Title
Page Builder: Pagelayer – Drag and Drop website builder < 2.0.6 - Authenticated (Author+) Insecure Direct Object Reference