Is CVE-2026-61945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61945 being exploited in the wild.

How severe is CVE-2026-61945?

Medium severity, with a CVSS score of 6.5, published 23 July 2026.

Which products and versions are affected?

MultiVendorX WooCommerce Product Stock Alert up to 3.0.6.

Is there a fix for CVE-2026-61945?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61945 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61945?

Check whether you run MultiVendorX WooCommerce Product Stock Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61945: MultiVendorX WooCommerce Product Stock Alert sensitive data exposure

CVE-2026-61945 · Severity: medium · CVSS 6.5 · Published 2026-07-23

A vulnerability in the WooCommerce Product Stock Alert plugin for WordPress allows logged-in users with low-level permissions to access sensitive system information. This could lead to the exposure of internal data that is normally restricted, potentially aiding attackers in further compromising the website. Business operations may be impacted if confidential configuration or system details are leaked to unauthorized parties.

Vendors: MultiVendorX.

Quick answers

Is CVE-2026-61945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61945 being exploited in the wild.
How severe is CVE-2026-61945?: Medium severity, with a CVSS score of 6.5, published 23 July 2026.
Which products and versions are affected?: MultiVendorX WooCommerce Product Stock Alert up to 3.0.6.
Is there a fix for CVE-2026-61945?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61945 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61945?: Check whether you run MultiVendorX WooCommerce Product Stock Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MultiVendorX WooCommerce Product Stock Alert plugin for WordPress (versions up to and including 3.0.6) is vulnerable to 'Exposure of Sensitive System Information to an Unauthorized Control Sphere' (CWE-497). This vulnerability allows an authenticated attacker with low-level privileges, such as a Subscriber, to retrieve sensitive data embedded within the system's control sphere. The attack is reachable over the network and does not require user interaction. The issue is addressed in version 3.1.0 of the plugin.

Affected products

MultiVendorX WooCommerce Product Stock Alert up to 3.0.6

Timeline

2026-03-23: other: Reported by Jakub Herman
2026-07-16: advisory: Patchstack advisory published
2026-07-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.