CVE-2026-16746 Overview
CVE-2026-16746 affects the MultiVendorX WordPress plugin in versions prior to 5.0.11. The plugin fails to verify that a requested store belongs to the authenticated user within one of its REST API endpoints. Any vendor-level account can query the endpoint and retrieve commission data and financial records belonging to other vendors on the same marketplace. The flaw is a broken access control issue [CWE-284] impacting confidentiality of vendor financial information across multi-vendor WordPress marketplaces.
Critical Impact
Authenticated vendor users can read other vendors' commission and financial data through an unprotected REST API endpoint.
Affected Products
- MultiVendorX WordPress plugin versions before 5.0.11
- WordPress sites operating multi-vendor marketplaces with the plugin installed
- Vendor accounts on affected MultiVendorX deployments
Discovery Timeline
- 2026-08-05 - CVE-2026-16746 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16746
Vulnerability Analysis
The MultiVendorX plugin exposes REST API endpoints that return vendor-specific commission and financial data. One of these endpoints accepts a store identifier from the request but does not check whether the identifier corresponds to the calling user's own vendor account. As a result, an attacker with any vendor-level account can substitute the identifier of a different vendor and receive that vendor's private financial records in the response.
This is an Insecure Direct Object Reference (IDOR) pattern. The endpoint relies on authentication alone and treats authorization as implicit. The server never enforces the ownership relationship between the authenticated user and the requested resource. According to the WPScan Vulnerability Report, the flaw is present in production releases through 5.0.10.
Root Cause
The root cause is a missing authorization check on a REST API endpoint. The permission callback for the affected route validates that the requester is logged in and has a vendor role, but it does not compare the requested store_id against the vendor identifier tied to the current user. Broken object-level authorization of this kind is tracked as [CWE-639].
Attack Vector
An attacker registers or compromises any vendor-level account on the target marketplace. The attacker then sends authenticated HTTP requests to the vulnerable REST endpoint while iterating through vendor or store identifiers. The response body returns commission totals, payout information, and other financial fields for the specified vendor. No elevation of privilege, chained exploit, or user interaction is required beyond having a valid vendor session.
See the WPScan Vulnerability Report for technical details of the affected endpoint.
Detection Methods for CVE-2026-16746
Indicators of Compromise
- Requests from a single authenticated vendor account to MultiVendorX REST endpoints referencing multiple distinct store_id or vendor identifier values in a short window.
- Access log entries showing enumeration patterns against /wp-json/ routes exposed by the MultiVendorX plugin.
- Unexpected 200 OK responses to vendor API queries where the requested store does not belong to the calling user.
Detection Strategies
- Review WordPress REST API access logs for sequential or scripted requests to MultiVendorX endpoints originating from vendor accounts.
- Correlate authenticated user identifiers with the store identifiers present in request parameters, and alert on mismatches.
- Deploy a Web Application Firewall (WAF) rule that inspects MultiVendorX API calls and blocks vendor-to-vendor identifier crossover.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and forward logs to a centralized SIEM for analysis.
- Baseline normal vendor API request volume and alert on deviations that suggest enumeration.
- Audit vendor account creation events, particularly self-service registrations, for accounts that immediately begin issuing API requests.
How to Mitigate CVE-2026-16746
Immediate Actions Required
- Upgrade MultiVendorX to version 5.0.11 or later on all affected WordPress installations.
- Audit existing vendor accounts and disable any accounts that show enumeration behavior against MultiVendorX REST endpoints.
- Rotate API keys and credentials associated with vendor accounts if exposure is suspected.
Patch Information
The vendor addressed CVE-2026-16746 in MultiVendorX 5.0.11 by adding the missing ownership check to the affected REST API endpoint. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. Verify the installed version equals or exceeds 5.0.11 after upgrade.
Workarounds
- If immediate patching is not possible, restrict access to the MultiVendorX REST API routes at the web server or WAF layer to trusted IP ranges.
- Temporarily disable self-service vendor registration to reduce the pool of accounts capable of exploiting the endpoint.
- Monitor and rate-limit authenticated requests to /wp-json/ routes exposed by the plugin.
# Verify the installed MultiVendorX version via WP-CLI
wp plugin get dc-woocommerce-multi-vendor --field=version
# Update to the patched release
wp plugin update dc-woocommerce-multi-vendor --version=5.0.11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
