---
id: "CVE-2026-127211"
page: "https://infrastack.ai/live/CVE-2026-127211"
kind: "vulnerability"
aliases: ["CVE-2026-127211"]
title: "MultiVendorX WordPress plugin: vendors can read other stores' private data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["marketplace", "multivendorx", "package", "wordpress"]
not_affected_if: ["no-vendor-accounts", "plugin-5.0.22-or-later", "plugin-not-installed"]
published_at: "2026-11-12T22:19:21+00:00"
first_seen_at: "2026-11-12T22:40:38+00:00"
updated_at: "2026-11-12T22:42:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127211", "first_seen_at": "2026-11-12T22:40:38+00:00"}]
exploit_sources: []
---

# MultiVendorX WordPress plugin: vendors can read other stores' private data

Link for people: https://infrastack.ai/live/CVE-2026-127211 (this .md is for agents)

The MultiVendorX plugin for WordPress has a broken access control flaw in its stores REST route. A logged-in vendor can read other stores' contact emails, pending withdrawal amounts, and onboarding data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MultiVendorX plugin version in the WordPress admin plugin list or the plugin's main file header.
- Confirm whether the store_owner role is used on the site and whether vendors can log in.

## Fix

- MultiVendorX plugin: `5.0.22` or later (the description says versions before 5.0.22 are affected).

## Timeline

- 2026-11-12T22:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127211

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-stores-rest-route

## From the sources

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_