The MultiVendorX WordPress plugin before version 5.0.11 has a flaw in its REST API that fails to confirm the requested store belongs to the authenticated user. As a result, any user with vendor‑level permissions can fetch commission and financial details for stores they do not own. This allows attackers to read sensitive monetary information about other vendors, constituting a confidentiality breach. The vulnerability is described by CWE‑639.

Affected systems are sites that have the MultiVendorX WordPress plugin installed. Versions prior to 5.0.11 are vulnerable. The vulnerability applies to any installation of the plugin regardless of hosting environment, as long as the plugin is enabled and the REST API is accessible.

With a CVSS score of 2.7 the vulnerability is classified as low severity. The risk level is low for organizations that rely on MultiVendorX for multi‑vendor marketplaces, because an authenticated vendor can expose valuable financial data to other vendors. The exploit requires only legitimate credentials with vendor‑level access; no privileged or administrator permissions are needed. EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Attackers would trigger the REST call to the commissions endpoint after authenticating as any vendor, then parse the returned JSON to obtain commission records of other stores.