Is there a public PoC exploit available for CVE-2026-74926?

Yes, a public proof-of-concept exploit is available for CVE-2026-74926. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-74926?

Yes, a patch is available for CVE-2026-74926. Update the affected software to the latest version immediately.

Multivendorx CVE-2026-74926

EUVD-2026-80174

2026-09-16 WPScan

GHSA-r99r-q28p-h387

WordPress Information Disclosure Multivendorx

Lifecycle Timeline

Patch available

Sep 16, 2026 - 07:01 EUVD

CVE Published

Sep 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

Analysis

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Multivendorx

View all

CVE-2026-16605 HIGH This Week POC

7.2 Aug 05

Broken object-level authorization in the MultiVendorX WordPress plugin before 5.0.11 allows any authenticated vendor (St

CVE-2026-74925 HIGH This Week POC

7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi

CVE-2023-5348 MEDIUM This Month POC

6.1 Dec 18

The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or e

CVE-2024-8289 CRITICAL Act Now

9.8 Sep 04

The MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privi

CVE-2026-74927 MEDIUM This Month POC

5.3 Sep 02

Unauthenticated information disclosure in the MultiVendorX WordPress plugin (versions prior to 5.0.15) exposes sensitive

CVE-2024-25929 CRITICAL Act Now

9.1 Jun 09

Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.0.5. Rated c

CVE-2024-31304 HIGH This Week

8.8 Jun 09

Missing Authorization vulnerability in MultiVendorX WC Marketplace.1.3. Rated high severity (CVSS 8.8), this vulnerabili

CVE-2026-66441 HIGH This Week

7.5 Aug 13

Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restric

CVE-2025-48261 HIGH This Week

7.5 Jun 09

CVE-2025-48261 is an information disclosure vulnerability in MultiVendorX that allows unauthenticated remote attackers t

CVE-2026-16746 LOW Monitor POC

2.7 Aug 05

Insecure Direct Object Reference (IDOR) in the MultiVendorX WordPress plugin before 5.0.11 exposes confidential financia

CVE-2026-66651 MEDIUM This Month

6.5 Aug 18

Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers t

CVE-2025-48263 MEDIUM This Month

6.5 May 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX Multi

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2026-74926 vulnerability details – vuln.today

Back