WordPress Plugin Vulnerabilities

MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

Description

The plugin does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

Proof of Concept

Affects Plugins

Plugin icon
dc-woocommerce-multi-vendor
Fixed in 5.0.15

References

CVE
CVE-2026-74927

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.vercel.app
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
c81aa489-0663-40b7-b2ce-f4c8f2edd4b6

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2025-11-24
Title
PropertyHive < 2.1.13 - Missing Authorization
Published
2026-08-05
Title
Legal Text Connector of the IT-Recht Kanzlei < 1.0.14 - Missing Authorization
Published
2025-05-26
Title
Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration
Published
2024-03-28
Title
AI WP Writer < 3.6.5.6 - Missing Authorization
Published
2026-01-16
Title
Wallet System for WooCommerce < 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation