MultiVendorX CVE-2026-12951

Exploitation requires an authenticated account with vendor-level privileges or higher - specifically the 'edit_stores' capability - on a WordPress site running the Dc Woocommerce Multi Vendor (MultiVendorX) plugin version 5.0.18 or earlier with the MarketplaceCompliance module active. The attacker must reach the /multivendorx/v1/compliance/report-abuse REST endpoint and control the 'order_by' parameter, which is injected into an ORDER BY clause where esc_sql() offers no protection. Limiting factors: the required vendor-level authentication excludes anonymous and low-privilege (subscriber/customer) users, so the realistic threat is a malicious or compromised vendor rather than an internet-wide unauthenticated attacker; sites not using the compliance/report-abuse feature or on patched versions are not exposed.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:N, score 6.5) describes a network-reachable, low-complexity attack that nonetheless requires authentication at vendor level ('edit_stores' capability), with impact limited to confidentiality (database read) and no integrity or availability effect. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, so there is no confirmed signal of active exploitation; likewise no public proof-of-concept is referenced. The signals are internally consistent - this is a real, exploitable SQLi (CWE-89) confirmed by Wordfence researchers reviewing the source, but the PR:L requirement meaningfully narrows the attacker population to users who already hold a vendor account on the marketplace, which is the primary factor keeping real-world risk below what the 'SQL injection' label alone might suggest. EPSS and KEV data are absent, so no exploitation-probability cross-check is possible; treat exploitation likelihood as unquantified rather than low.

An attacker who registers or compromises a vendor-level account on a MultiVendorX marketplace sends a request to the /multivendorx/v1/compliance/report-abuse REST endpoint with a malicious 'order_by' value. Because the parameter is concatenated into an ORDER BY clause with only esc_sql() applied (which does not neutralize ORDER BY context), they inject subqueries to read sensitive data such as other users' credentials or PII from the WordPress database. No public exploit code is identified at time of analysis, but the flaw is confirmed by Wordfence source review and is straightforward to weaponize.