CVE-2026-16605: MultiVendorX Auth Bypass Vulnerability

CVE-2026-16605 Overview

CVE-2026-16605 is a missing authorization vulnerability in the MultiVendorX WordPress plugin before version 5.0.11. The plugin's REST API does not verify that the store targeted by a request belongs to the requesting vendor. An authenticated vendor with Store Owner privileges or above can view, take over, permanently delete, or modify any other vendor's store on the marketplace. The flaw is classified as [CWE-862] Missing Authorization. Successful exploitation compromises confidentiality, integrity, and availability of every store hosted on an affected marketplace.

Critical Impact
Any authenticated Store Owner can hijack, wipe, or alter any other vendor's store through the plugin's REST API.

Affected Products

MultiVendorX WordPress plugin versions prior to 5.0.11
WordPress marketplaces running vulnerable MultiVendorX installations
Vendor stores managed via the MultiVendorX REST API

Discovery Timeline

2026-08-05 - CVE-2026-16605 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16605

Vulnerability Analysis

MultiVendorX exposes REST API endpoints that let vendors manage their own stores. The affected endpoints accept a store identifier from the request but do not check whether the identifier matches the authenticated vendor. Because the ownership check is missing, the API treats any authenticated Store Owner (or higher role) as authorized against any store ID supplied. This turns a per-tenant management API into a marketplace-wide administrative surface. An attacker who registers as a vendor, or who compromises any existing vendor account, can enumerate store IDs and act on them at will. Actions include reading private store data, replacing store settings, transferring ownership, and permanently deleting stores.

Root Cause

The root cause is broken access control in the REST API permission callbacks. The endpoints authenticate the caller and confirm the role, but omit the authorization step that binds the caller's vendor identity to the target store record. This is a textbook Insecure Direct Object Reference falling under [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires authenticated access as a Store Owner or higher. The attack is delivered over the network against the WordPress REST API and requires no user interaction. After authenticating, the attacker issues REST requests referencing another vendor's store ID and receives the same access the legitimate owner would have. See the WPScan Vulnerability Reference for endpoint-level detail.

// No verified proof-of-concept code is published for CVE-2026-16605.
// Refer to the WPScan advisory for endpoint specifics.

Detection Methods for CVE-2026-16605

Indicators of Compromise

REST API requests to MultiVendorX endpoints where the authenticated user ID does not match the vendor owning the referenced store ID.
Unexpected changes to store metadata, payout settings, or ownership fields on vendor records.
Sudden deletion of vendor stores or products without a corresponding admin action in the WordPress audit log.

Detection Strategies

Enable REST API request logging and correlate the authenticated user with the target store ID on every MultiVendorX call.
Alert on any vendor account that issues write operations against more than one distinct store ID within a short window.
Review web server access logs for enumeration patterns against /wp-json/ MultiVendorX routes.

Monitoring Recommendations

Baseline normal per-vendor API call volume and alert on deviations, especially bursts of PUT, POST, or DELETE requests.
Monitor the WordPress database for out-of-band writes to vendor and store tables.
Track new vendor registrations followed quickly by REST API activity against foreign store IDs.

How to Mitigate CVE-2026-16605

Immediate Actions Required

Update the MultiVendorX plugin to version 5.0.11 or later on every affected WordPress site.
Audit vendor accounts and revoke or reset credentials for any account showing suspicious REST API activity.
Review recent store modifications, ownership transfers, and deletions to identify unauthorized changes.

Patch Information

The vendor addressed the issue in MultiVendorX 5.0.11 by enforcing an ownership check on the affected REST API endpoints. Details are available in the WPScan Vulnerability Reference.

Workarounds

Restrict access to /wp-json/ MultiVendorX routes at the web application firewall until the patch is applied.
Temporarily disable the MultiVendorX plugin on marketplaces that cannot update immediately.
Reduce the number of accounts holding the Store Owner role and above to the minimum required for operations.

bash

# Update MultiVendorX via WP-CLI
wp plugin update multivendorx --version=5.0.11
wp plugin get multivendorx --field=version