CVE-2026-127211

{
  "etk_id": "ETK-2026-4327",
  "cve_id": "CVE-2026-127211",
  "display_id": "CVE-2026-127211",
  "ghsa_id": "GHSA-g9c6-724g-v3p4",
  "euvd_id": "EUVD-2026-124725",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in MultiVendorX for WordPress",
  "summary": "MultiVendorX for WordPress versions before 5.0.22 do not adequately enforce store ownership for certain REST API handlers. An authenticated vendor may be able to view sensitive information associated with other stores; access to a vendor account is required.",
  "mitigation": "Upgrade MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions to version 5.0.22 or later. Review vendor accounts and limit access for untrusted vendors until the update is applied.",
  "vendor": "MultiVendorX",
  "product": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.0.22"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.0.22"
      ],
      "package_name": "MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.296401933333332,
  "t0_at": "2026-11-12T21:47:55.920000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-12T22:49:18.660045+00:00",
      "days": 0.04262430607638889,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T21:47:55.920000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-12T21:47:55.920000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T21:47:55.920000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-127211"
    }
  }
}