CVE-2026-16605— MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
Quick assessment
Affected
Unknown MultiVendorX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress MultiVendorX是WordPress基金会的一款电商多供应商组件。 WordPress MultiVendorX 5.0.11之前版本存在安全漏洞，该漏洞源于未验证通过REST API访问的目标商店是否属于请求的供应商，可能导致经过身份验证的供应商（商店所有者及以上）查看、接管、永久删除或修改其他供应商的商店。
Possible ATT&CK Techniques 3 AI
T1498 · Network Denial of Service T1110 · Brute Force T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | MultiVendorX | < 5.0.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16605
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress MultiVendorX 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress MultiVendorX是WordPress基金会的一款电商多供应商组件。 WordPress MultiVendorX 5.0.11之前版本存在安全漏洞，该漏洞源于未验证通过REST API访问的目标商店是否属于请求的供应商，可能导致经过身份验证的供应商（商店所有者及以上）查看、接管、永久删除或修改其他供应商的商店。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | MultiVendorX | 0 ~ 5.0.11 | - |
|
II. Public POCs for CVE-2026-16605
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16605
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16605 (1)
-
🔗 MultiVendorX < 5.0.11 – Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization | CVE 2026-16605 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-05 · 24 CVEs total
| CVE-2026-16993 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Up | |
| CVE-2026-17515 | MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per | |
| CVE-2026-16036 | miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding | |
| CVE-2026-16055 | Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_log | |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | |
| CVE-2026-14553 | Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload | |
| CVE-2026-15210 | Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeov | |
| CVE-2026-15230 | YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclo | |
| CVE-2026-15372 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider | |
| CVE-2026-15360 | Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args | |
| CVE-2026-16940 | Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path T | |
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR | |
| CVE-2026-16561 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure | |
| CVE-2026-16968 | GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users | |
| CVE-2026-16942 | WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS | |
| CVE-2026-16603 | Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure | |
| CVE-2026-16736 | User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registrati | |
| CVE-2026-16613 | GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF | |
| CVE-2026-16604 | Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Co | |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commission |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: MultiVendorX
-
CVE-2026-66651
WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Cont -
CVE-2026-66441
WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Cont -
CVE-2026-16746
MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission -
CVE-2025-49916
WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Cont -
CVE-2025-48261
WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exp
Same vendor: Unknown
-
CVE-2026-78572
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injectio -
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr
V. Comments for CVE-2026-16605
No comments yet