Is CVE-2026-74926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74926 being exploited in the wild.

How severe is CVE-2026-74926?

High severity, with a CVSS score of 7.1, published 16 September 2026.

Which products and versions are affected?

MultiVendorX Dc-Woocommerce-Multi-Vendor 5.0.0 to 5.0.15.

Is there a fix for CVE-2026-74926?

A patch was published on 2026-09-16: Fixed in version 5.0.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74926 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-74926?

Check whether you run MultiVendorX Dc-Woocommerce-Multi-Vendor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74926: MultiVendorX WordPress plugin authorization bypass in REST API

CVE-2026-74926 · Severity: high · CVSS 7.1 · Published 2026-09-16

MultiVendorX is a WordPress plugin that enables multi-vendor e-commerce functionality on WooCommerce sites. An authorization flaw in its REST API allows any logged-in user—even those with minimal permissions like subscribers—to modify any store's details, payment settings, and ownership records, potentially enabling store hijacking and data theft.

Vendors: MultiVendorX.

Quick answers

Is CVE-2026-74926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74926 being exploited in the wild.
How severe is CVE-2026-74926?: High severity, with a CVSS score of 7.1, published 16 September 2026.
Which products and versions are affected?: MultiVendorX Dc-Woocommerce-Multi-Vendor 5.0.0 to 5.0.15.
Is there a fix for CVE-2026-74926?: A patch was published on 2026-09-16: Fixed in version 5.0.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74926 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-74926?: Check whether you run MultiVendorX Dc-Woocommerce-Multi-Vendor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in one of the plugin's REST API routes. An authenticated but unprivileged user (such as a subscriber) can send a crafted API request to modify store metadata, payout settings, and ownership associations for any store in the system, not just their own. The attack requires only a valid WordPress user account; no additional authentication or user interaction is needed. An attacker can fully take over a store by changing its owner field and financial settings. The vulnerability was fixed in version 5.0.16; all versions 5.0.0 through 5.0.15 are affected.

Affected products

MultiVendorX dc-woocommerce-multi-vendor 5.0.0 to 5.0.15

Timeline

2026-09-14: disclosed
2026-09-16: advisory
2026-09-16: patched: Fixed in version 5.0.16

References

https://wpscan.com/vulnerability/35ff7d7e-b3fe-4ae2-92cd-a122b8cdd97c/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.