CVE-2026-16605 is a missing authorization vulnerability (CWE-862) in the MultiVendorX WordPress plugin prior to version 5.0.11. The plugin's REST API does not verify that the store being accessed belongs to the authenticated vendor making the request. As a result, an authenticated vendor with Store Owner or higher privileges can perform unauthorized actions on other vendors' stores, including viewing sensitive data, taking control, deleting, or modifying those stores. This vulnerability impacts the confidentiality, integrity, and availability of vendor stores within the marketplace.

An attacker who is an authenticated vendor with Store Owner or higher privileges can exploit this vulnerability to fully compromise other vendors' stores. This includes unauthorized data disclosure, modification, deletion, and complete takeover of other vendor stores. The impact affects confidentiality, integrity, and availability of the affected stores, potentially disrupting marketplace operations and causing significant damage to vendor assets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict vendor privileges to the minimum necessary and monitor for suspicious activity related to store management. Avoid granting Store Owner or higher privileges unless absolutely necessary. Follow vendor updates closely for any released patches or official mitigations.