MultiVendorX CVE-2026-66441

No authentication is required - the CVSS vector PR:N confirms exploitation is possible by any unauthenticated remote user. The target site must be running WordPress with the MultiVendorX plugin installed and active at version 5.0.10 or earlier. The site must be internet-accessible or reachable by the attacker over the network (AV:N). No specific non-default configuration is required beyond having the plugin installed, as the missing authorization check is present in the default plugin code path. Exploitation is limited to read-only data access (C:H/I:N/A:N); the attacker cannot modify data or cause service disruption through this vulnerability alone. Sites that have already removed or deactivated the plugin, or updated beyond 5.0.10, are not affected.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N signals a high-priority exposure: fully network-exploitable, trivially low complexity, requiring no credentials or user interaction, with high confidentiality impact. In practice, this means any internet-facing WordPress site running the plugin is immediately targetable by automated scanners. No EPSS score is available from the provided data, and the vulnerability has not been added to the CISA KEV catalog, suggesting no confirmed in-the-wild exploitation at time of analysis. However, the zero-barrier exploitation profile (unauthenticated, network-based, low complexity) means weaponization risk is high and exploitation latency post-disclosure is typically short for WordPress plugin flaws. The impact is confidentiality-only, which limits blast radius versus a full RCE or write-access flaw, but vendor/customer PII or financial data exfiltration is still a significant business risk for marketplace operators. No conflicting signals identified; CVSS vector aligns with the 'unauthenticated broken access control' description.

An unauthenticated attacker sends a crafted HTTP GET or POST request directly to the vulnerable MultiVendorX plugin endpoint - discoverable via publicly known WordPress REST API or admin-ajax patterns. Because no authorization check is performed, the server returns restricted marketplace data such as vendor order details, customer PII, or commission records. No public exploit code has been identified, but the low technical barrier means automated WordPress scanning tools could trivially probe for and exploit this flaw.