# CVE-2026-12941: MultiVendorX WooCommerce Marketplace SQL injection in order_by parameter

Source: https://junglewise.ai/threats/cve-2026-12941-multivendorx-woocommerce-marketplace-sql-injection-in-order-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-12941 · Severity: medium · CVSS 6.5 · Published 2026-07-16

The MultiVendorX plugin for WordPress, which allows websites to operate as multi-seller marketplaces, contains a security flaw that allows logged-in users to access sensitive database information. By exploiting a weakness in how the plugin handles search and sorting requests, an attacker could extract private data from the site's database. This is particularly risky because, in default configurations, any registered user can automatically become a 'store owner' and gain the permissions necessary to perform this attack.

Technologies: [MultiVendorX](https://junglewise.ai/threats/technologies/multivendorx). Vendors: [MultiVendorX](https://junglewise.ai/threats/vendors/multivendorx).

## Quick answers

**Is CVE-2026-12941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12941 being exploited in the wild.

**How severe is CVE-2026-12941?** Medium severity, with a CVSS score of 6.5, published 16 July 2026.

**Which products and versions are affected?** MultiVendorX Up to and including 5.0.9.

**Is there a fix for CVE-2026-12941?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12941 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-12941?** Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MultiVendorX plugin for WordPress is vulnerable to a generic SQL injection due to insufficient escaping and lack of preparation on the 'order_by' parameter within the Transactions REST API endpoint. An attacker with subscriber-level access can exploit this by first self-registering as a 'store_owner' via the public Stores REST endpoint (a capability enabled by default in many configurations), which grants the 'edit_stores' permission. Once authorized, the attacker can append malicious SQL queries to existing database calls to exfiltrate sensitive data. The vulnerability is present in all versions up to and including 5.0.9.

## Affected products

- MultiVendorX (formerly WC Marketplace) MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions Up to and including 5.0.9

## Timeline

- 2026-07-16: disclosed: Initial disclosure of the vulnerability.
- 2026-07-16: advisory: NVD and Wordfence published advisories.

## References

- [https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/RestAPI/Controllers/Transactions.php](https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/RestAPI/Controllers/Transactions.php)
- [https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/RestAPI/Controllers/Transactions.php](https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/RestAPI/Controllers/Transactions.php)
- [https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/Transaction/Transaction.php](https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/classes/Transaction/Transaction.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3606843%40dc-woocommerce-multi-vendor&new=3606843%40dc-woocommerce-multi-vendor](https://plugins.trac.wordpress.org/changeset?reponame=&old=3606843%40dc-woocommerce-multi-vendor&new=3606843%40dc-woocommerce-multi-vendor)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/c55bf5f5-20d5-4157-94d3-1a330cdc82df?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/c55bf5f5-20d5-4157-94d3-1a330cdc82df?source=cve)

## Related threats

- [MultiVendorX broken access control in stores REST route](https://junglewise.ai/threats/cve-2026-127211-multivendorx-plugin-for-wordpress-before-5-0-22-contains-a)
- [MultiVendorX WordPress plugin missing authorization in debug download](https://junglewise.ai/threats/cve-2026-119745-multivendorx-plugin-for-wordpress-before-5-0-21-contains-a)
- [MultiVendorX WordPress plugin authorization bypass in settings endpoint](https://junglewise.ai/threats/cve-2026-108695-multivendorx-wordpress-plugin-through-5-0-19-contains-an)
- [MultiVendorX privilege escalation to administrator](https://junglewise.ai/threats/cve-2026-74925-multivendorx-privilege-escalation-to-administrator)
- [MultiVendorX plugin missing authorization in REST API](https://junglewise.ai/threats/cve-2026-74927-multivendorx-plugin-missing-authorization-in-rest-api)