Vulnerabilities / MultiVendorX / WPSEC-2026-0110
MultiVendorX <= 5.0.18 - Authenticated (Store Owner+) Cross-Store Follower Information Disclosure via FollowStore REST Endpoint
Medium 4.3
CWE-639Fixed in 5.0.19
- ID
- WPSEC-2026-0110
- Plugin
- MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions (dc-woocommerce-multi-vendor)
- Affected
- from 5.0.0 before 5.0.19
- Remediation
- Update to 5.0.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- MultiVendorX on WPSec AttackSurface
- Fix released
- Published
Description
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 5.0.0 through 5.0.18 due to the FollowStore REST endpoint returning the followers of any store passed in the store_id parameter without checking that the caller manages that store. This makes it possible for authenticated attackers, with store owner-level access, to retrieve the names and email addresses of other stores' followers.
References
- https://wpsec.com/vuln/WPSEC-2026-0110/
- https://plugins.svn.wordpress.org/dc-woocommerce-multi-vendor/tags/5.0.19/
- https://wordpress.org/plugins/dc-woocommerce-multi-vendor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS