What is the CVSS score of CVE-2026-66441?

CVE-2026-66441 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of MultiVendorX are affected by CVE-2026-66441?

The MultiVendorX WordPress plugin (versions 5.0.10 and earlier) contains a critical broken access control vulnerability that allows unauthenticated attackers to retrieve restricted marketplace data,…

How to fix or mitigate CVE-2026-66441?

Within 24 hours, inventory all WordPress instances running MultiVendorX and document installed versions; immediately disable the plugin as an emergency containment measure and implement firewall rules to block external access to affected endpoints. Within 7 days, review access logs for the plugin's endpoints to identify any unauthorized data retrieval attempts, assess what data may have been exposed, and notify vendors and customers if unauthorized access is confirmed. Within 30 days, monitor vendor advisories for a security patch; once MultiVendorX releases a fix, upgrade to the patched version, conduct a comprehensive security audit of marketplace data access controls, and evaluate whether additional marketplace API hardening is required.

MultiVendorX CVE-2026-66441

EUVD-2026-57867 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-pmm9-qmcr-8vpp

WordPress Authentication Bypass Multivendorx Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible, unauthenticated missing authorization check with read-only high confidentiality impact; no integrity or availability effect confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:38 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

AnalysisAI

Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.

Technical ContextAI

MultiVendorX is a WooCommerce-integrated WordPress plugin that enables multi-vendor marketplace functionality, managing vendor storefronts, orders, commissions, and customer data. CPE cpe:2.3:a:multivendorx:multivendorx:*:*:*:*:*:*:*:* confirms all versions through 5.0.10 are affected. CWE-862 (Missing Authorization) indicates that specific REST API routes, AJAX action handlers, or admin-area endpoints lack WordPress capability checks (e.g., current_user_can()) or nonce validation, allowing unauthenticated HTTP requests to reach functionality that should require at minimum subscriber-level authentication. The CVSS confidentiality impact of High with zero integrity or availability impact suggests the exploitable endpoints are read-only data retrieval paths rather than write operations.

RemediationAI

Update the MultiVendorX plugin to a version above 5.0.10 immediately; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-5-0-10-broken-access-control-vulnerability for the confirmed patched release version, as an exact fix version was not independently confirmed from the available data. The WordPress plugin repository update page (wp-admin > Plugins > Available Updates) should reflect the patched release. If immediate patching is not possible, a compensating control is to use a Web Application Firewall (WAF) such as Patchstack's virtual patch service or Wordfence to block unauthenticated requests to the vulnerable endpoints - note this requires knowing the specific endpoint paths and may block legitimate plugin functionality. Restricting access to the WordPress admin and REST API to known IP ranges via server-level firewall rules reduces exposure but does not eliminate it if the vulnerable endpoints are on the public-facing REST or AJAX surface. Disabling the MultiVendorX plugin entirely is the most complete interim mitigation, at the cost of marketplace functionality.