What is GHSA-w6w9-w293-w3m5?

GHSA-w6w9-w293-w3m5 is a security advisory published by GitHub Security Advisories with High severity. The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through...

Which CVE IDs does GHSA-w6w9-w293-w3m5 cover?

GHSA-w6w9-w293-w3m5 covers the following CVE IDs: CVE-2026-16605. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w6w9-w293-w3m5?

GHSA-w6w9-w293-w3m5 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-w6w9-w293-w3m5HighCVSS 7.2

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-16605 →

📋 Description

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated vendor (Store Owner and above) to view, take over, permanently delete, or modify any other vendor's store on the marketplace.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16605
https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad01737654a
https://github.com/advisories/GHSA-w6w9-w293-w3m5