CVE-2026-74927: MultiVendorX WordPress Information Disclosure

CVE-2026-74927 is an information disclosure flaw in MultiVendorX WordPress plugin that exposes vendor contact details, payout information, and administrative notes through an unsecured REST API endpoint. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-74927 Overview

CVE-2026-74927 is a missing authorization vulnerability in the MultiVendorX WordPress plugin versions before 5.0.15. The plugin exposes a REST API listing route without proper authorization checks. Unauthenticated attackers can retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. The flaw is tracked under CWE-862: Missing Authorization and is reachable remotely over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can enumerate sensitive vendor and payout data from any affected MultiVendorX marketplace, exposing personally identifiable information and internal administrative notes.

Affected Products

MultiVendorX WordPress plugin versions prior to 5.0.15
WordPress sites operating multi-vendor marketplaces using MultiVendorX
Any deployment exposing the vulnerable REST API endpoint to the public internet

Discovery Timeline

2026-09-02 - CVE-2026-74927 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-74927

Vulnerability Analysis

The MultiVendorX plugin registers a REST API listing route intended for administrative or vendor-scoped use. The route does not validate the caller's identity or capability before returning results. As a consequence, any anonymous HTTP client can request the endpoint and receive structured data about registered vendors and their financial state.

The returned payload includes vendor contact fields, payout configuration data, pending payout amounts, and administrative notes attached to store applications. Administrative notes typically contain internal decisions about vendor approval and can disclose business logic that should never leave the admin context.

The issue is categorized as CWE-862: Missing Authorization. The confidentiality-only impact reflects that the endpoint discloses data but does not, by itself, modify records or affect availability. Refer to the WPScan Vulnerability Report for the underlying research.

Root Cause

The root cause is the absence of a permission_callback enforcing capability checks on the affected register_rest_route handler. WordPress REST routes must explicitly gate access; when the callback returns true or is omitted, the route becomes publicly accessible.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to the vulnerable REST endpoint on a target WordPress site. The server returns a JSON response containing vendor and payout records. No credentials, tokens, or user interaction are required. The attacker can iterate pagination parameters to enumerate every vendor record stored by the marketplace.

No verified public exploit code is available at this time. See the WPScan advisory for endpoint specifics.

Detection Methods for CVE-2026-74927

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ routes registered by the MultiVendorX plugin returning 200 OK with vendor data.
Repeated requests from a single source IP iterating page or per_page query parameters against MultiVendorX REST routes.
Access log entries showing large JSON response sizes from MultiVendorX endpoints without a preceding authentication request.

Detection Strategies

Inspect web server access logs for anonymous requests to MultiVendorX REST namespaces and correlate response sizes against baseline.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated access to the affected listing route.
Audit plugin version inventory across WordPress estates and flag MultiVendorX installations below 5.0.15.

Monitoring Recommendations

Alert on outbound data volume anomalies from WordPress hosts running MultiVendorX.
Monitor for scraping patterns such as sequential pagination and consistent user-agent strings hitting /wp-json/ routes.
Log and review all REST API 200 responses that return vendor or payout fields to unauthenticated sessions.

How to Mitigate CVE-2026-74927

Immediate Actions Required

Upgrade the MultiVendorX plugin to version 5.0.15 or later on every affected WordPress site.
Rotate any vendor credentials, API keys, or payout tokens that may have been exposed through the listing route.
Review server access logs for prior anonymous requests to MultiVendorX REST endpoints and notify affected vendors if disclosure is confirmed.

Patch Information

The MultiVendorX maintainers addressed the missing authorization check in version 5.0.15. Administrators should apply the update through the WordPress plugin manager or WP-CLI. See the WPScan Vulnerability Report for the authoritative fix reference.

Workarounds

Restrict access to /wp-json/ MultiVendorX namespaces at the reverse proxy or WAF until the plugin is upgraded.
Disable the MultiVendorX plugin on production sites that cannot be patched immediately.
Enforce IP allowlisting on administrative and vendor REST routes where marketplace clients are known.

bash

# Nginx example: block unauthenticated access to the vulnerable REST namespace
location ~* ^/wp-json/multivendorx/ {
    if ($http_authorization = "") { return 403; }
    proxy_pass http://wordpress_upstream;
}