CVE-2026-12951Published
MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-12951 · Microsoft / collected KEV context
cve-program · CVE-2026-12951
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6131f5d7-cc67-493f-81d0-12b822d27a0e?source=cve
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/modules/MarketplaceCompliance/Util.php#L98
- https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/5.0.8/modules/MarketplaceCompliance/Rest.php#L119
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3721134%40dc-woocommerce-multi-vendor&new=3721134%40dc-woocommerce-multi-vendor
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.