MultiVendorX CVE-2026-66651

The MultiVendorX plugin must be installed and active on a WordPress site running WooCommerce, with plugin version 5.0.14 or earlier present. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no non-default configuration is required - exploitation targets the plugin's default-active endpoints. No special conditions apply beyond plugin presence: remote unauthenticated exploitation is possible against any default deployment of MultiVendorX ≤ 5.0.14. Limiting factors include: the plugin must be actively installed (it is not a WordPress core component), the scope is unchanged meaning impact is bounded to the plugin's data domain, and the specific sensitive actions accessible without authorization are not disclosed in the available description, which limits attacker awareness without additional reconnaissance.

The CVSS base score of 6.5 (Medium) reflects constrained impact: partial confidentiality and integrity loss (C:L/I:L) with no availability impact, and unchanged scope (S:U), meaning exploitation is limited to the plugin's own data domain rather than full site takeover. Counterbalancing this, the attack prerequisites are minimal - network access with no authentication, no interaction, and low complexity (AV:N/AC:L/PR:N/UI:N) - making exploitation trivially automatable and scalable across exposed WordPress installations. No EPSS score was supplied in the input, so statistical exploitation probability cannot be quantified. The absence of a KEV listing and identified POC suggests active exploitation has not been broadly confirmed. The specific endpoint and functionality affected by the missing authorization check are not disclosed in the description, which introduces uncertainty: if the unprotected action touches sensitive vendor financials, order manipulation, or user PII, real-world impact could exceed what the C:L/I:L rating implies. Risk is moderate but actionable, primarily for sites running WooCommerce multi-vendor storefronts.

An unauthenticated attacker sends a crafted HTTP request - targeting a MultiVendorX REST API or AJAX endpoint that lacks a capability check - to a WordPress site running version ≤ 5.0.14, gaining the ability to read restricted vendor data or perform write operations such as modifying product listings, vendor settings, or order records. The low attack complexity and absence of authentication requirements mean this can be scripted and run against bulk lists of WordPress sites. No public exploit code has been identified at time of analysis.