CVE-2026-16746 — LOW (2.7) — White Hats Nepal

Vulnerability Description

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

CVSS Score

2.7

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd/

FAQ

What is CVE-2026-16746?

CVE-2026-16746 is a vulnerability with a CVSS score of 2.7 (LOW). The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other ven...

How severe is CVE-2026-16746?

CVE-2026-16746 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-16746?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.