Junglewise Threat Intelligence

CVE-2026-12941: MultiVendorX WooCommerce Marketplace SQL injection in order_by parameter

CVE-2026-12941 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Technologies: MultiVendorX. Vendors: MultiVendorX.

Executive brief

The MultiVendorX plugin for WordPress, which allows websites to operate as multi-seller marketplaces, contains a security flaw that allows logged-in users to access sensitive database information. By exploiting a weakness in how the plugin handles search and sorting requests, an attacker could extract private data from the site's database. This is particularly risky because, in default configurations, any registered user can automatically become a 'store owner' and gain the permissions necessary to perform this attack.

Technical details

The MultiVendorX plugin for WordPress is vulnerable to a generic SQL injection due to insufficient escaping and lack of preparation on the 'order_by' parameter within the Transactions REST API endpoint. An attacker with subscriber-level access can exploit this by first self-registering as a 'store_owner' via the public Stores REST endpoint (a capability enabled by default in many configurations), which grants the 'edit_stores' permission. Once authorized, the attacker can append malicious SQL queries to existing database calls to exfiltrate sensitive data. The vulnerability is present in all versions up to and including 5.0.9.

Affected products

  • MultiVendorX (formerly WC Marketplace) MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions Up to and including 5.0.9

Timeline

  • 2026-07-16: disclosed: Initial disclosure of the vulnerability.
  • 2026-07-16: advisory: NVD and Wordfence published advisories.

References

Related threats