What is GHSA-vwqj-46fj-33p7?

GHSA-vwqj-46fj-33p7 is a security advisory published by GitHub Security Advisories with Medium severity. The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on...

Which CVE IDs does GHSA-vwqj-46fj-33p7 cover?

GHSA-vwqj-46fj-33p7 covers the following CVE IDs: CVE-2026-74927. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwqj-46fj-33p7?

GHSA-vwqj-46fj-33p7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-vwqj-46fj-33p7MediumCVSS 5.3

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-74927 →

📋 Description

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-74927
https://wpscan.com/vulnerability/c81aa489-0663-40b7-b2ce-f4c8f2edd4b6
https://github.com/advisories/GHSA-vwqj-46fj-33p7