CVE-2026-74926

{"id": "CVE-2026-74926", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "MultiVendorX", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.16", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T06:16:31.397", "references": [{"url": "https://wpscan.com/vulnerability/35ff7d7e-b3fe-4ae2-92cd-a122b8cdd97c/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it."}], "lastModified": "2026-09-16T20:25:29.240", "sourceIdentifier": "contact@wpscan.com"}