CVE-2026-74927: CWE-862 Missing Authorization in MultiVendorX

CVE-2026-74927 describes a missing authorization control in the MultiVendorX WordPress plugin before version 5.0.15. Specifically, one of the plugin's REST API listing routes does not properly restrict access, enabling unauthenticated attackers to retrieve sensitive vendor-related information including contact and payout details, pending payouts, and administrative notes tied to store applications. This vulnerability is categorized under CWE-862, indicating a failure to enforce proper authorization checks.

The vulnerability allows unauthenticated users to access sensitive vendor information that should be restricted, potentially leading to privacy violations and exposure of payout and administrative data. However, it does not allow modification or denial of service. The CVSS score of 5.3 reflects a medium severity impact with low complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is unspecified, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected REST API endpoints via web application firewall rules or other access controls to mitigate unauthorized data exposure.