What is the CVSS score of CVE-2026-16746?

CVE-2026-16746 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16746?

Yes, a public proof-of-concept exploit is available for CVE-2026-16746. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16746?

Yes, a patch is available for CVE-2026-16746. Update the affected software to the latest version immediately.

MultiVendorX CVE-2026-16746

EUVD-2026-53109 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-05 WPScan

GHSA-xm3p-gghg-f4v9

WordPress Authentication Bypass Multivendorx Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Vendor role is low-privilege (any registered seller), not high-privilege; confidentiality impact is limited to financial records only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:23 vuln.today

CVSS changed

Aug 06, 2026 - 16:22 NVD

2.7 (LOW)

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financial and commission data across vendor accounts. Any authenticated vendor-level user can query a REST API endpoint using an arbitrary store identifier to retrieve another vendor's earnings and commission records, bypassing per-store ownership validation entirely. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists per WPScan, and the low EPSS score (0.14%, 4th percentile) suggests limited opportunistic scanning activity at this time.

Technical ContextAI

MultiVendorX (CPE: cpe:2.3:a:unknown:multivendorx:*:*:*:*:*:*:*:*) is a WordPress plugin that enables multi-vendor marketplace functionality. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR where a server-side operation accepts a user-supplied key - here a store or vendor identifier - without verifying the requesting user is the owner of the resource that key resolves to. The affected REST API endpoint presumably accepts a store ID as a path or query parameter and returns commission/financial records without asserting that the authenticated vendor's account matches the requested store. This is a horizontal privilege escalation: a vendor gains read access to peer-level resources they are not entitled to, without requiring any administrative access.

RemediationAI

Upgrade to MultiVendorX version 5.0.11 or later, the first release containing the ownership-verification fix per the WPScan advisory at https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd/. If immediate upgrade is not feasible, the most targeted compensating control is to restrict access to the affected REST API endpoint via a WAF or nginx/Apache rule that blocks requests to that endpoint from non-owner sessions - though this requires identifying the exact endpoint path from the WPScan PoC. Alternatively, temporarily restricting new vendor registrations limits the pool of potential attackers (existing vendor accounts would still be a risk). Disabling the plugin entirely is the most conservative option but removes marketplace functionality. There are no known side effects of upgrading to 5.0.11 beyond the authorization fix itself.