CVE-2026-16746
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 05, 2026
Vendor
unknown
Description
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.