MultiVendorX CVE-2026-16746

Exploitation requires an active vendor-level account on the target WordPress installation running MultiVendorX before 5.0.11. The attacker must be authenticated and hold the vendor role - anonymous or subscriber-level users cannot reach the vulnerable endpoint. The vulnerability is limited to read access on financial/commission data; no write, delete, or code-execution capability is exposed. It does not require any non-default configuration: any standard MultiVendorX deployment with multiple vendor accounts is vulnerable. Exploitation is further limited to environments where multiple vendors exist, as the attack only yields meaningful data when other stores are present to query.

The official CVSS 3.1 score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects a narrow impact: confidentiality-only, no integrity or availability exposure, and the highest privilege tier (PR:H). However, classifying a marketplace vendor as PR:H merits scrutiny - in a multi-vendor WordPress deployment, vendor accounts are relatively accessible to anyone who registers as a seller, making the effective privilege bar closer to PR:L. This discrepancy means the real-world exploitability is likely higher than the 2.7 score implies. EPSS at 0.14% (4th percentile) is consistent with a niche plugin vulnerability unlikely to be mass-scanned. Despite no CISA KEV listing, WPScan has confirmed and published a proof-of-concept, meaning any registered vendor on a vulnerable marketplace can trivially execute the attack. The business impact - exposure of competitor revenue and commission data - is meaningful in a commercial marketplace context even though it does not constitute system compromise.

A registered vendor on a target marketplace logs in, then iterates numeric or UUID-based store IDs in the REST API endpoint - no brute-force resistance is needed given AC:L. For each valid store ID belonging to a competitor, the endpoint returns commission rates, payout totals, and transaction history. A publicly available PoC from WPScan documents the exact endpoint and parameter, making this trivially reproducible by any vendor with network access to the WordPress installation.