CVE-2026-12941 is a SQL Injection vulnerability (CWE-89) in the MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress. The vulnerability arises from insufficient escaping and lack of proper preparation of the 'order_by' parameter in SQL queries. Authenticated attackers with subscriber-level privileges can exploit this issue when the plugin's store approval setting is set to automatically approve store owners, enabling them to self-register as store owners and access the vulnerable transactions endpoint. This allows attackers to append additional SQL commands to extract sensitive information from the database. The vulnerability affects all versions up to and including 5.0.9. No official patch or remediation guidance is currently provided.

Successful exploitation allows authenticated users with subscriber-level access to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information. The vulnerability does not impact integrity or availability according to the CVSS vector but has a high confidentiality impact. The exploit requires specific plugin configuration (automatic store owner approval) and authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the automatic store approval setting to prevent unauthorized elevation to store owner roles, thereby limiting access to the vulnerable endpoint. Monitoring and restricting subscriber-level user capabilities may also reduce risk.