CVE-2026-66651: MultiVendorX Auth Bypass Vulnerability

CVE-2026-66651 Overview

CVE-2026-66651 is an unauthenticated broken access control vulnerability in the MultiVendorX WordPress plugin (formerly dc-woocommerce-multi-vendor) affecting versions up to and including 5.0.14. The flaw is classified under CWE-862: Missing Authorization and allows a remote attacker to reach plugin functionality without providing credentials. Successful exploitation impacts confidentiality and integrity of vendor-related data on affected WordPress marketplaces. The issue is tracked in the Patchstack Vulnerability Report.

Critical Impact
Unauthenticated attackers can invoke protected plugin actions over the network with low attack complexity and no user interaction, leading to disclosure and modification of vendor data.

Affected Products

MultiVendorX WordPress plugin versions <= 5.0.14
WordPress sites operating the dc-woocommerce-multi-vendor plugin
WooCommerce marketplaces relying on MultiVendorX for vendor management

Discovery Timeline

2026-08-18 - CVE-2026-66651 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66651

Vulnerability Analysis

The vulnerability stems from missing authorization checks in one or more request handlers exposed by the MultiVendorX plugin. The plugin fails to validate whether the caller possesses the required capability or nonce before executing sensitive operations. As a result, requests originating from unauthenticated clients are processed as if they came from a legitimate actor.

The issue falls under CWE-862: Missing Authorization. Attackers reach the vulnerable endpoints directly over HTTP or HTTPS without needing an account on the target site. Impact is limited to low confidentiality and low integrity effects, with no direct availability degradation reported. The Exploit Prediction Scoring System (EPSS) probability is 0.194% as of 2026-08-21.

Root Cause

The plugin's request handlers do not enforce capability checks (for example, current_user_can()) or nonce validation before executing privileged logic. WordPress plugins that expose AJAX actions through wp_ajax_nopriv_* hooks or REST routes with permissive permission_callback functions commonly fall into this class of flaw. See the Patchstack Vulnerability Report for the vendor-specific details.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends crafted HTTP requests to the affected plugin endpoints on a vulnerable WordPress installation. Because no privileges or user interaction are required, the flaw is suitable for opportunistic scanning across public WordPress marketplaces. The attacker can read or modify vendor-scoped data exposed by the unauthenticated handlers.

No public exploit code is currently listed for this CVE. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2026-66651

Indicators of Compromise

Unauthenticated POST or GET requests to MultiVendorX AJAX endpoints such as /wp-admin/admin-ajax.php?action=<mvx_action> originating from unusual IP addresses.
REST API calls to plugin routes under /wp-json/mvx/ or /wp-json/multivendorx/ without an accompanying authentication cookie or nonce.
Unexpected changes to vendor profile, product, or commission records without a corresponding administrator login event.

Detection Strategies

Enable WordPress and WooCommerce audit logging to record all plugin AJAX and REST activity, then alert on requests missing an authenticated session.
Deploy a web application firewall (WAF) rule that flags high-volume requests to MultiVendorX endpoints from a single source.
Correlate web server logs against the running plugin version to identify hosts still exposing <= 5.0.14.

Monitoring Recommendations

Track outbound modifications to WooCommerce vendor tables and diff them against an approved change baseline.
Monitor for scanner user-agents probing dc-woocommerce-multi-vendor paths across your WordPress fleet.
Ingest WordPress and reverse-proxy logs into a centralized SIEM to enable retrospective hunts once the CVE is confirmed exploited in the wild.

How to Mitigate CVE-2026-66651

Immediate Actions Required

Inventory all WordPress sites running the MultiVendorX (dc-woocommerce-multi-vendor) plugin and record the installed version.
Update the plugin to a version above 5.0.14 as soon as the vendor publishes a fix.
Restrict administrative and REST endpoints behind a WAF or reverse proxy allowlist while patching is in progress.

Patch Information

At time of writing, the Patchstack Vulnerability Report is the authoritative reference. Site owners should apply the plugin update from the official WordPress plugin repository once released, then verify the installed version is greater than 5.0.14 from the WordPress admin Plugins screen.

Workarounds

Disable and remove the MultiVendorX plugin on sites that do not currently require multi-vendor functionality.
Use a WAF virtual patch to block unauthenticated requests to admin-ajax.php actions and REST routes associated with the plugin.
Enforce IP allowlisting on /wp-admin/ and marketplace management endpoints to limit exposure of unauthenticated handlers.

bash

# Example Nginx snippet to block unauthenticated access to MultiVendorX REST routes
location ~ ^/wp-json/(mvx|multivendorx)/ {
    if ($http_cookie !~ "wordpress_logged_in_") {
        return 403;
    }
}