# CVE-2026-74927: MultiVendorX plugin missing authorization in REST API

Source: https://junglewise.ai/threats/cve-2026-74927-multivendorx-plugin-missing-authorization-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74927 · Severity: medium · CVSS 5.3 · Published 2026-09-02

The MultiVendorX WordPress plugin fails to properly verify user permissions on a REST API endpoint that lists vendor and store information. Unauthenticated attackers can access sensitive business data including vendor contact details, bank account information, payment processor addresses, payout amounts, administrative rejection notes, and vendor deactivation reasons without logging in.

Technologies: [MultiVendorX](https://junglewise.ai/threats/technologies/multivendorx). Vendors: [MultiVendorX](https://junglewise.ai/threats/vendors/multivendorx).

## Quick answers

**Is CVE-2026-74927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74927 being exploited in the wild.

**How severe is CVE-2026-74927?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** MultiVendorX before 5.0.15.

**Is there a fix for CVE-2026-74927?** A patch was published on 2026-09-02: Fixed in version 5.0.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74927 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74927?** Check whether you run MultiVendorX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MultiVendorX WordPress plugin contains a missing authorization vulnerability in its REST API `/wp-json/multivendorx/v1/stores` endpoint. The endpoint uses nonce validation to verify CSRF tokens but does not check user capabilities or authentication status; an unauthenticated attacker can obtain a public nonce from the Store Registration page and use it to retrieve sensitive data through query parameters (store_registration=1, pending_withdraw=1, deactivate=1). The vulnerability exposes vendor personally identifiable information (tax IDs, bank sort codes, phone numbers, PayPal addresses), payout amounts, administrative notes, and free-text deactivation reasons. The root cause is reliance on nonce validation alone without capability checks. A fix is available in version 5.0.15 and later.

## Affected products

- MultiVendorX MultiVendorX before 5.0.15

## Timeline

- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 5.0.15
- 2026-09-02: advisory

## References

- [https://wpscan.com/vulnerability/c81aa489-0663-40b7-b2ce-f4c8f2edd4b6/](https://wpscan.com/vulnerability/c81aa489-0663-40b7-b2ce-f4c8f2edd4b6/)

## Related threats

- [MultiVendorX broken access control in stores REST route](https://junglewise.ai/threats/cve-2026-127211-multivendorx-plugin-for-wordpress-before-5-0-22-contains-a)
- [MultiVendorX WordPress plugin missing authorization in debug download](https://junglewise.ai/threats/cve-2026-119745-multivendorx-plugin-for-wordpress-before-5-0-21-contains-a)
- [MultiVendorX WordPress plugin authorization bypass in settings endpoint](https://junglewise.ai/threats/cve-2026-108695-multivendorx-wordpress-plugin-through-5-0-19-contains-an)
- [MultiVendorX privilege escalation to administrator](https://junglewise.ai/threats/cve-2026-74925-multivendorx-privilege-escalation-to-administrator)
- [MultiVendorX WooCommerce Marketplace SQL injection in order_by parameter](https://junglewise.ai/threats/cve-2026-12941-multivendorx-woocommerce-marketplace-sql-injection-in-order-by)