Is CVE-2026-127211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127211 being exploited in the wild.

How severe is CVE-2026-127211?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

Is there a fix for CVE-2026-127211?

Yes: fixed in 5.0.22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127211 attacked?

It is attacked over the network.

Am I affected by CVE-2026-127211?

Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127211: MultiVendorX broken access control in stores REST route

CVE-2026-127211 · Severity: medium · CVSS 6.5 · Published 2026-11-12

MultiVendorX is a WordPress plugin that enables merchants to build multi-vendor marketplaces similar to Amazon or eBay. A broken access control vulnerability allows any authenticated vendor to view sensitive data from other vendors' stores, including contact emails, withdrawal amounts, and visitor analytics, without proper authorization checks.

Technologies: MultiVendorX. Vendors: MultiVendorX.

Quick answers

Is CVE-2026-127211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127211 being exploited in the wild.
How severe is CVE-2026-127211?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: MultiVendorX before 5.0.22.
Is there a fix for CVE-2026-127211?: Yes: fixed in 5.0.22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127211 attacked?: It is attacked over the network.
Am I affected by CVE-2026-127211?: Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.0.22

Technical details

The /wp-json/multivendorx/v1/stores REST endpoint grants the store_owner role edit_stores capability but lacks per-store ownership validation, enabling insecure direct object references. Authenticated attackers with vendor privileges can access the visitorMap and flag handlers to enumerate and retrieve confidential data across multiple stores. A fix is available in version 5.0.22 and later.

Affected products

MultiVendorX MultiVendorX before 5.0.22

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.