{"id":"CVE-2026-127211","kind":"vulnerability","aliases":["CVE-2026-127211"],"related":[],"title":"MultiVendorX WordPress plugin: vendors can read other stores' private data","description":"MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.","summary":"The MultiVendorX plugin for WordPress has a broken access control flaw in its stores REST route. A logged-in vendor can read other stores' contact emails, pending withdrawal amounts, and onboarding data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketplace","multivendorx","package","wordpress"],"not_affected_if":["no-vendor-accounts","plugin-5.0.22-or-later","plugin-not-installed"],"how_to_check":"- Check the installed MultiVendorX plugin version in the WordPress admin plugin list or the plugin's main file header.\n- Confirm whether the store_owner role is used on the site and whether vendors can log in.","fix":"- MultiVendorX plugin: `5.0.22` or later (the description says versions before 5.0.22 are affected).","status":"open","published_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","triaged_at":"2026-11-12T22:42:30+00:00","updated_at":"2026-11-12T22:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T22:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- MultiVendorX plugin: `5.0.22` or later (the description says versions before 5.0.22 are affected).","reach":"internet","title":"MultiVendorX WordPress plugin: vendors can read other stores' private data","impact":"medium","summary":"The MultiVendorX plugin for WordPress has a broken access control flaw in its stores REST route. A logged-in vendor can read other stores' contact emails, pending withdrawal amounts, and onboarding data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","multivendorx","marketplace"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"vendors read other stores' private contact and financial data","analyst_note":"","how_to_check":"- Check the installed MultiVendorX plugin version in the WordPress admin plugin list or the plugin's main file header.\n- Confirm whether the store_owner role is used on the site and whether vendors can log in.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-5.0.22-or-later","no-vendor-accounts"],"who_is_affected":"Sites running the MultiVendorX plugin for WordPress below 5.0.22 where vendors hold accounts with the store_owner role. An attacker needs a vendor login; sites without vendor accounts or without this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4684,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127211':13A,16A '-2026':12A,15A '/wp-json/multivendorx/v1/stores':68C '5.0.22':59C 'access':29B,63C,76C 'administr':77C 'allow':72C 'amount':50B,122C 'analyt':131C 'attack':98C 'authent':73C 'breach':139C 'broken':28B,62C 'capabl':90C 'check':97C 'confidenti':138C 'contact':46B,118C 'contain':60C 'control':30B,64C 'cross':136C 'cross-ten':135C 'cve':11A,14A 'data':10A,53B,126C 'deactiv':127C 'direct':103C 'due':80C 'edit':88C 'email':47B,119C 'exploit':100C 'flag':78C,112C 'flaw':31B 'handler':79C,109C,113C 'insecur':102C 'log':39B 'logged-in':38B 'marketplac':17B 'miss':92C 'multivendorx':1A,18B,22B,54C 'object':104C 'onboard':52B,123C 'owner':84C 'ownership':96C 'packag':19B 'pend':48B,120C 'per':94C 'per-stor':93C 'plugin':3A,23B,55C 'possess':86C 'privat':9A 'read':6A,43B 'reason':128C 'refer':105C 'registr':125C 'rest':35B,69C 'result':132C 'retriev':115C 'role':85C 'rout':36B,70C 'store':8A,34B,45B,83C,89C,95C,117C 'tenant':137C 'vendor':4A,41B,74C 'visitor':130C 'visitormap':108C 'vulner':65C 'withdraw':49B,121C 'wordpress':2A,20B,25B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MultiVendorX plugin for WordPress below 5.0.22 where vendors hold accounts with the store_owner role. An attacker needs a vendor login; sites without vendor accounts or without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","marketplace","multivendorx","package","wordpress"],"campaign_type":null,"search_a":"'-127211':13A,16A '-2026':12A,15A 'cve':11A,14A 'data':10A 'multivendorx':1A 'plugin':3A 'privat':9A 'read':6A 'store':8A 'vendor':4A 'wordpress':2A","search_b":"'access':29B 'amount':50B 'broken':28B 'contact':46B 'control':30B 'data':53B 'email':47B 'flaw':31B 'log':39B 'logged-in':38B 'marketplac':17B 'multivendorx':18B,22B 'onboard':52B 'packag':19B 'pend':48B 'plugin':23B 'read':43B 'rest':35B 'rout':36B 'store':34B,45B 'vendor':41B 'withdraw':49B 'wordpress':20B,25B","search_c":"'/wp-json/multivendorx/v1/stores':68C '5.0.22':59C 'access':63C,76C 'administr':77C 'allow':72C 'amount':122C 'analyt':131C 'attack':98C 'authent':73C 'breach':139C 'broken':62C 'capabl':90C 'check':97C 'confidenti':138C 'contact':118C 'contain':60C 'control':64C 'cross':136C 'cross-ten':135C 'data':126C 'deactiv':127C 'direct':103C 'due':80C 'edit':88C 'email':119C 'exploit':100C 'flag':78C,112C 'handler':79C,109C,113C 'insecur':102C 'miss':92C 'multivendorx':54C 'object':104C 'onboard':123C 'owner':84C 'ownership':96C 'pend':120C 'per':94C 'per-stor':93C 'plugin':55C 'possess':86C 'reason':128C 'refer':105C 'registr':125C 'rest':69C 'result':132C 'retriev':115C 'role':85C 'rout':70C 'store':83C,89C,95C,117C 'tenant':137C 'vendor':74C 'visitor':130C 'visitormap':108C 'vulner':65C 'withdraw':121C 'wordpress':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:19:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127211","severity":null,"published_at":"2026-11-12T22:19:21+00:00","modified_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[{"id":139826,"url":"https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-stores-rest-route","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}