Skip to main content

MultiVendorX CVE-2026-66651

| EUVDEUVD-2026-60931 MEDIUM
Missing Authorization (CWE-862)
2026-08-18 Patchstack GHSA-fx55-rw83-58r5
WordPress Authentication Bypass Multivendorx Wordpress Plugin
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable endpoint with no authentication required; partial read/write impact confined to plugin data domain, no availability or scope-change impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
Analysis Generated
Aug 18, 2026 - 15:39 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.

AnalysisAI

Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The MultiVendorX plugin must be installed and active on a WordPress site running WooCommerce, with plugin version 5.0.14 or earlier present. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS base score of 6.5 (Medium) reflects constrained impact: partial confidentiality and integrity loss (C:L/I:L) with no availability impact, and unchanged scope (S:U), meaning exploitation is limited to the plugin's own data domain rather than full site takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update MultiVendorX to the first release beyond 5.0.14 once a patched version is confirmed by the vendor or Patchstack; monitor the advisory at https://patchstack.com/database/wordpress/plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-5-0-14-broken-access-control-vulnerability for the exact patched version, as none is confirmed in available data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Multivendorx

View all
CVE-2026-16605 HIGH POC
7.2 Aug 05

Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-5348 MEDIUM POC
6.1 Dec 18

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e
CVE-2024-8289 CRITICAL
9.8 Sep 04

The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi
CVE-2026-74927 MEDIUM POC
5.3 Sep 02

Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive
CVE-2024-25929 CRITICAL
9.1 Jun 09

Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c
CVE-2024-31304 HIGH
8.8 Jun 09

Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2026-66441 HIGH
7.5 Aug 13

Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric
CVE-2025-48261 HIGH
7.5 Jun 09

CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t
CVE-2026-16746 LOW POC
2.7 Aug 05

Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia
CVE-2025-48263 MEDIUM
6.5 May 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX Multi
CVE-2026-81792 MEDIUM
6.5 Sep 08

Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (ve

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-66651 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy