What is the CVSS score of CVE-2026-16605?

CVE-2026-16605 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of MultiVendorX are affected by CVE-2026-16605?

The MultiVendorX WordPress plugin has an authorization flaw enabling vendors to sabotage competitor stores, compromise customer data, and delete entire storefronts on shared marketplace platforms.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16605?

Yes, a public proof-of-concept exploit is available for CVE-2026-16605. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16605?

Within 24 hours, inventory all WordPress instances running MultiVendorX and document current versions; evaluate network segmentation if immediate patching is not feasible. Within 7 days, deploy MultiVendorX version 5.0.11 or later to all affected instances and verify successful installation across your environment. Within 30 days, audit vendor account activity logs for unauthorized cross-store operations, implement vendor role-based access controls, and establish monitoring alerts for suspicious REST API calls targeting stores outside a vendor's assigned tenant.

MultiVendorX CVE-2026-16605

EUVD-2026-53106 HIGH

Missing Authorization (CWE-862)

2026-08-05 WPScan

GHSA-w6w9-w293-w3m5

WordPress Authentication Bypass Multivendorx Unknown

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network REST API vector, low complexity once credentialed; PR:H reflects vendor role requirement; full CIA impact from cross-tenant store read, modification, and deletion.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:25 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

7.2 (HIGH)

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.

AnalysisAI

Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (Store Owner role or above) to perform unauthorized cross-tenant operations against other vendors' stores via the REST API. The plugin fails to verify that the target store in a REST API request belongs to the authenticated vendor, enabling confidentiality breaches, store takeovers, permanent deletion, and arbitrary modification of competitor or co-platform stores. A publicly available exploit exists; EPSS probability is low (0.14%, 4th percentile) suggesting opportunistic or targeted exploitation rather than mass scanning, and this CVE is not currently listed in the CISA KEV catalog.

Technical ContextAI

MultiVendorX (CPE: cpe:2.3:a:unknown:multivendorx:*:*:*:*:*:*:*:*) is a WordPress plugin that transforms WooCommerce into a multi-vendor marketplace, granting each vendor management over their own store entity. The root cause is CWE-862 (Missing Authorization): REST API endpoints accept a store identifier as a parameter but perform no server-side ownership check to confirm the requesting vendor is entitled to operate on that store. This is a classic Broken Object Level Authorization (BOLA/IDOR) pattern - the application trusts the caller-supplied resource ID rather than enforcing resource-ownership scoping. Because WordPress REST API routes are network-accessible and authentication is handled separately from authorization, any vendor with valid credentials can substitute any other store's identifier in API calls.

RemediationAI

Upgrade MultiVendorX to version 5.0.11 or later immediately - this is the vendor-released patch that introduces store-ownership verification on REST API requests. Update via the WordPress plugin dashboard or by downloading directly from the plugin repository. Until patching is complete, consider restricting vendor REST API access at the network or WAF layer by blocking or rate-limiting requests to the MultiVendorX REST API namespace for non-administrative accounts - note this may disrupt legitimate vendor store management operations. Review REST API access logs for anomalous cross-vendor store ID references as an indicator of prior exploitation. Audit vendor accounts for unauthorized privilege escalation or store ownership changes. Advisory and exploit reference: https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad01737654a/.