CVE-2026-66651

WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.

We have discovered 304 live websites that are affected by CVE-2026-66651.

Run a Free Instant Scan



Affected Software

Product  Dc Woocommerce Multi Vendor
Category Wordpress Plugins
Vulnerable Domains304 live websites (100% of Dc Woocommerce Multi Vendor install base)
Vulnerable Versions
  • from 0 through 5.0.14
Vulnerable Versions Count56 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 18, 2026
  • Updated - Aug 18, 2026

Credits

  • Jakub Herman | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-66651
United States107 websites


France23 websites
Germany18 websites
Cyprus17 websites
GB10 websites
India9 websites
Brazil8 websites
South Africa7 websites
Italy7 websites
Russia6 websites

Website Distribution by TLD

Number of websites using CVE-2026-66651
.com170 websites
.net11 websites
.fr9 websites
.com.br7 websites
.org6 websites
.it6 websites
.co.uk5 websites
.nl4 websites
.ru4 websites
.de3 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-66651

Top websites that are affected by CVE-2026-66651. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.**.il Israel**,***
***.com United States***,***
**********.com Malaysia***,***
*************.info GB***,***
*****************.**.uk United States***,***
**********.com United States*,***,***
****************.com India*,***,***
************.com France*,***,***
***************.com France*,***,***
**********.com United States*,***,***
See full domain list

FAQ

CVE-2026-66651 is Missing Authorization in Dc Woocommerce Multi Vendor
A total of 304 websites have been identified as vulnerable to CVE-2026-66651, based on global website indexing conducted by WebTechSurvey.
The Dc Woocommerce Multi Vendor is affected by the CVE-2026-66651 vulnerability.
Dc Woocommerce Multi Vendor versions up to and including 5.0.14 are vulnerable to CVE-2026-66651.