CVE-2026-12941 wcmp CVE debrief

Who should care

WordPress site administrators using the MultiVendorX plugin, especially those with subscriber-level users, should prioritize updating to a patched version. Site owners should review their store approval settings and consider restricting access to the vulnerable transactions endpoint. Security teams should monitor for suspicious database queries and implement additional security measures for subscriber-level users.

Technical summary

The MultiVendorX plugin for WordPress is vulnerable to SQL Injection due to insufficient escaping of the 'order_by' parameter and lack of preparation on existing SQL queries. Authenticated attackers with subscriber-level access can append additional SQL queries, potentially extracting sensitive information from the database. The vulnerability is exacerbated by the default store approval setting, which allows self-registration as a store owner and grants the edit_stores capability required to reach the vulnerable transactions endpoint.

Defensive priority

Medium priority due to the CVSS score of 6.5 and the potential for sensitive information disclosure.

Recommended defensive actions

• Update the MultiVendorX plugin to the latest version
• Restrict access to the vulnerable transactions endpoint
• Monitor for suspicious database queries
• Implement additional security measures for subscriber-level users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed by the CVE record and NVD detail. The exploitability is enhanced by the default store approval setting allowing self-registration as a store owner. Evidence limits suggest that additional verification is required to confirm the scope of affected systems and to assess potential impact on sensitive data. Defenders should verify the configuration of store approval settings and monitor for suspicious database queries. Additional review of the plugin's transactions endpoint and database schema may be necessary to fully understand the vulnerability.

Official resources