Veille CVE

Septembre 2026

4 CVE

Critique 0 Élevée 2 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « MultiVendorX » ✕
  1. CVE-2026-74926 7.1 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

  2. CVE-2026-74925 7.2 Élevée

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

  3. CVE-2026-81792 6.5 Moyenne

    MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX

    Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.

  4. CVE-2026-74927 5.3 Moyenne

    Unknown MultiVendorX

    The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.