# CVE-2026-127211: MultiVendorX broken access control in stores REST route

Source: https://junglewise.ai/threats/cve-2026-127211-multivendorx-plugin-for-wordpress-before-5-0-22-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-127211 · Severity: medium · CVSS 6.5 · Published 2026-11-12

MultiVendorX is a WordPress plugin that enables merchants to build multi-vendor marketplaces similar to Amazon or eBay. A broken access control vulnerability allows any authenticated vendor to view sensitive data from other vendors' stores, including contact emails, withdrawal amounts, and visitor analytics, without proper authorization checks.

Technologies: [MultiVendorX](https://junglewise.ai/threats/technologies/multivendorx). Vendors: [MultiVendorX](https://junglewise.ai/threats/vendors/multivendorx).

## Quick answers

**Is CVE-2026-127211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-127211 being exploited in the wild.

**How severe is CVE-2026-127211?** Medium severity, with a CVSS score of 6.5, published 12 November 2026.

**Which products and versions are affected?** MultiVendorX before 5.0.22.

**Is there a fix for CVE-2026-127211?** Yes: fixed in 5.0.22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-127211 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-127211?** Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.22

## Technical details

The /wp-json/multivendorx/v1/stores REST endpoint grants the store_owner role edit_stores capability but lacks per-store ownership validation, enabling insecure direct object references. Authenticated attackers with vendor privileges can access the visitorMap and flag handlers to enumerate and retrieve confidential data across multiple stores. A fix is available in version 5.0.22 and later.

## Affected products

- MultiVendorX MultiVendorX before 5.0.22

## Timeline

- 2026-11-12: disclosed

## References

- [https://wordpress.org/plugins/dc-woocommerce-multi-vendor/](https://wordpress.org/plugins/dc-woocommerce-multi-vendor/)
- [https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-stores-rest-route](https://www.vulncheck.com/advisories/multivendorx-wordpress-plugin-broken-access-control-via-stores-rest-route)

## Related threats

- [MultiVendorX WordPress plugin missing authorization in debug download](https://junglewise.ai/threats/cve-2026-119745-multivendorx-plugin-for-wordpress-before-5-0-21-contains-a)
- [MultiVendorX WordPress plugin authorization bypass in settings endpoint](https://junglewise.ai/threats/cve-2026-108695-multivendorx-wordpress-plugin-through-5-0-19-contains-an)
- [MultiVendorX privilege escalation to administrator](https://junglewise.ai/threats/cve-2026-74925-multivendorx-privilege-escalation-to-administrator)
- [MultiVendorX plugin missing authorization in REST API](https://junglewise.ai/threats/cve-2026-74927-multivendorx-plugin-missing-authorization-in-rest-api)
- [MultiVendorX WooCommerce Marketplace SQL injection in order_by parameter](https://junglewise.ai/threats/cve-2026-12941-multivendorx-woocommerce-marketplace-sql-injection-in-order-by)