CVE-2026-74926 Overview
CVE-2026-74926 affects the MultiVendorX WordPress plugin in versions prior to 5.0.16. The plugin exposes a REST API route that fails to verify store ownership before processing requests. Any authenticated user, including low-privileged roles such as subscribers, can overwrite arbitrary store details, modify payout settings, and reassign store ownership records. The flaw is categorized as Missing Authorization [CWE-862] and impacts multi-vendor marketplaces built on WordPress.
Critical Impact
Authenticated attackers can hijack vendor stores, redirect payouts to attacker-controlled accounts, and tamper with marketplace integrity without ever holding vendor privileges.
Affected Products
- MultiVendorX WordPress plugin versions before 5.0.16
- WordPress sites operating multi-vendor marketplaces using MultiVendorX
- Vendor stores managed through the affected REST API routes
Discovery Timeline
- 2026-09-16 - CVE-2026-74926 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-74926
Vulnerability Analysis
The MultiVendorX plugin registers REST API routes to manage vendor stores. One of these routes accepts requests to update store metadata, payout configuration, and ownership assignments. The route validates that the caller is authenticated but does not check whether the authenticated user actually owns the target store. As a result, any logged-in account, including a subscriber created through open registration, can submit a crafted request that mutates another vendor's store record.
Because the route accepts an arbitrary store identifier in the request body, an attacker enumerates store IDs and issues authorized requests against each one. The plugin then persists attacker-controlled values into the store record, including the field that maps a store to its owning user. Reassigning ownership grants the attacker full control of the store through the normal vendor UI on subsequent requests.
Root Cause
The root cause is Missing Authorization [CWE-862] in the plugin's REST API permission callback. The callback does not compare the authenticated user's ID against the owner ID stored on the target resource. This omission collapses the authorization model from role-plus-ownership to authentication-only, which is insufficient for tenant-scoped data on a marketplace.
Attack Vector
The attack is network-based and requires only low-privileged authentication. An attacker registers a subscriber account on any site running an affected version, then sends a REST request to the vulnerable endpoint with a target store identifier and attacker-chosen values. No user interaction is required. Exploitation produces high-integrity impact by rewriting store data and low-availability impact when the takeover disrupts legitimate vendor operations.
No public proof-of-concept code has been published in the referenced advisory. Refer to the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-74926
Indicators of Compromise
- Unexpected changes to store owner IDs, store slugs, or store display names in the MultiVendorX database tables.
- Modifications to vendor payout settings, including bank account numbers, PayPal addresses, or Stripe connection identifiers, that were not initiated by the store owner.
- REST API requests to MultiVendorX store routes originating from user accounts that hold only the subscriber role.
Detection Strategies
- Review web server and WordPress logs for authenticated POST or PUT requests to /wp-json/ routes exposed by MultiVendorX, correlated with low-privilege user sessions.
- Compare current store ownership assignments against historical backups to identify unauthorized reassignments.
- Alert on newly registered subscriber accounts that immediately invoke vendor management REST endpoints.
Monitoring Recommendations
- Enable WordPress audit logging for user role changes and vendor metadata updates.
- Forward WordPress and web server logs to a centralized analytics platform for correlation across authentication and REST API activity.
- Monitor payout configuration fields for changes and require out-of-band confirmation for updates.
How to Mitigate CVE-2026-74926
Immediate Actions Required
- Upgrade the MultiVendorX plugin to version 5.0.16 or later on all WordPress sites.
- Audit all vendor store records for unauthorized changes to ownership and payout settings since the plugin was installed.
- Reset payout destination fields to verified values and notify affected vendors of any observed tampering.
- Review and remove subscriber accounts that were created without a legitimate business purpose.
Patch Information
The vendor addressed the vulnerability in MultiVendorX version 5.0.16 by enforcing an ownership check on the affected REST API route. Details are documented in the WPScan Vulnerability Report. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin archive.
Workarounds
- Disable open user registration on the WordPress site until the plugin is updated to prevent unauthenticated adversaries from obtaining subscriber accounts.
- Restrict access to /wp-json/ REST API routes exposed by MultiVendorX using a web application firewall rule that requires the vendor role.
- Temporarily deactivate the MultiVendorX plugin on sites that cannot be patched immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.