CVE-2026-39794

Executive Summary

CVE-2026-39794 is an unauthenticated Broken Access Control (CWE-862) vulnerability in the WooCommerce Multivendor Marketplace – REST API plugin, affecting versions up to and including 1.6.3. The flaw allows remote attackers with no authentication to access functionality or data that should require authorization, resulting in a high confidentiality impact (CVSS 7.5). Any WordPress site running the vulnerable plugin with its REST API exposed is at risk of unauthorized data disclosure.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization) and manifests within the REST API component of the WooCommerce Multivendor Marketplace plugin. In WordPress, REST API endpoints are registered with a permission_callback that determines whether a given request is authorized. When that callback is absent or returns true unconditionally, endpoints become reachable by unauthenticated users (the WordPress REST API does not require authentication by default for registered public routes).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates the following:

• Attack Vector (AV:N): exploitable over the network.
• Attack Complexity (AC:L): no special conditions are required.
• Privileges Required (PR:N): no authentication is needed.
• User Interaction (UI:N): no victim action is required.
• Scope (S:U): impact is confined to the vulnerable component.
• Confidentiality (C:H): high loss of confidentiality.
• Integrity (I:N) and Availability (A:N): no impact to data integrity or availability.

Because the plugin extends WooCommerce with vendor-facing REST endpoints, unauthenticated access to those routes can expose vendor records, order information, or other marketplace data that should be restricted to authenticated or privileged users. The NVD description does not enumerate the specific endpoints, parameters, or data objects involved, so the precise disclosure scope cannot be stated beyond the "REST API" attack surface. No code-level detail (function names, route paths beyond the plugin name, parameter identifiers) is available in the provided intelligence and none should be assumed.

The root cause class — a missing or ineffective authorization check on a REST route — is consistent across similar WordPress plugin CVEs. Attackers enumerate registered REST routes (/wp-json/) and probe vendor-related endpoints without supplying credentials or nonces, observing which return data that should be gated.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (unauthenticated broken access control in a WordPress REST API) rather than from any published exploit.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running WooCommerce and the Multivendor Marketplace plugin. This can be done by fingerprinting the public REST route index (/wp-json/), inspecting plugin assets referenced in the page source, or using internet-wide scan data. No login is required for this stage.

2. Triggering the flaw. The attacker issues unauthenticated HTTP requests to the plugin's registered REST API routes. Because the vulnerable endpoint lacks an effective authorization check (CWE-862), the request is processed without credentials, a nonce, or a valid session. The attacker iterates over candidate routes and methods (GET, and in some broken-access-control cases other verbs) to find those that return sensitive data. No specific route names or parameters are documented in the available intelligence; the vulnerable routes are the plugin's own REST endpoints.

3. Payload / execution method. At the vulnerability-class level, the "payload" is a crafted HTTP request to a REST route that omits authentication artifacts. Success is determined by whether the response contains data the requester is not entitled to see. No injection, memory corruption, or code execution primitive is involved — the exploit is purely an authorization bypass.

4. Post-exploitation impact. The consequence is unauthorized disclosure of marketplace data (Confidentiality: High). Integrity and Availability are unaffected per the CVSS vector. Disclosed data may feed further attacks, including social engineering, enumeration of order or vendor records, or reconnaissance for chained vulnerabilities. Because the flaw is unauthenticated and low-complexity, it scales trivially across many targets.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact.

Business impact centers on data exposure. Marketplace operators may leak vendor information, order metadata, or other customer/business data that is intended to be access-restricted. This can trigger:

• Regulatory and compliance obligations (e.g., GDPR) if personal data is disclosed.
• Reputational damage and erosion of vendor/merchant trust.
• Secondary targeting: exposed data lowers the cost of follow-on phishing or fraud.
• Operational cost of incident response, disclosure, and remediation.

Blast radius: any WordPress installation hosting the WooCommerce Multivendor Marketplace – REST API plugin at version <= 1.6.3 with the REST API reachable. Because no privileges are required and no user interaction is needed, the effective attack surface is every such site exposed to the internet. EPSS has not yet scored this CVE, and it is not in CISA KEV; there is currently no evidence of active exploitation.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to WooCommerce Multivendor Marketplace REST API
id: 3b7c1e2a-9d4f-4c8b-b6a1-2f9e7c0d1a45
status: experimental
description: Detects unauthenticated requests to the WooCommerce Multivendor Marketplace REST API that may indicate exploitation of CVE-2026-39794 (broken access control).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-39794
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-json/'
  selection_plugin:
    cs-uri-query|contains:
      - 'wc-multivendor'
      - 'multivendor'
  selection_status:
    sc-status:
      - 200
      - 201
  condition: selection_uri and selection_plugin and selection_status
falsepositives:
  - Legitimate authenticated API clients
  - Monitoring/health checks referencing the plugin namespace
level: medium
tags:
  - attack.t1190
  - cve.2026.39794

YARA Rule

rule CVE_2026_39794_WCMV_REST_Access
{
    meta:
        description = "Detects web access log or captured traffic references to WooCommerce Multivendor Marketplace REST API potentially abused for CVE-2026-39794"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-39794"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rest = "/wp-json/" ascii nocase
        $plugin1 = "wc-multivendor" ascii nocase
        $plugin2 = "multivendor-marketplace" ascii nocase
        $plugin3 = "multivendor" ascii nocase

    condition:
        $rest and any of ($plugin*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-39794 WooCommerce Multivendor Marketplace REST API Unauthenticated Access"; flow:established,to_server; http.uri; content:"/wp-json/"; http.uri; content:"multivendor"; nocase; http.method; content:"GET"; http.response_stat_code; content:"200"; sid:202639794; rev:1; reference:cve,2026-39794; metadata:mitre_tactic_technique T1190; classtype:attempted-recon;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "GET"
     and wildcard(http.request.path, "/wp-json/*multivendor*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "/wp-json/") AND match(uri_path, "(?i)multivendor")
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods by src_ip, uri_path, status
| where status >= 200 AND status < 300 AND count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-39794,">
  <rule id="100794" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/wp-json/</field>
    <field name="url">multivendor</field>
    <description>CVE-2026-39794: Possible unauthenticated access to WooCommerce Multivendor Marketplace REST API</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_39794,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version has been published in the intelligence available.

1. Immediate mitigations.

   • If the plugin is not actively needed, deactivate and remove it entirely.
   • Restrict access to the WordPress REST API at the perimeter: block or require authentication for /wp-json/ routes associated with the plugin using a WAF or reverse-proxy rule, allowing only known-good clients.
   • Apply deny-by-default authorization at the web tier for marketplace REST endpoints where operationally feasible.
   • Monitor web logs for unauthenticated 200 responses on plugin REST routes.

2. Patch / upgrade steps.

   • There is currently no patched version. Track the vendor's release channel and the WordPress plugin repository for a security release beyond 1.6.3.
   • When a fix ships, upgrade the plugin to the first version that remediates CVE-2026-39794, validate in staging, then deploy. Re-verify that authorization checks are enforced on all REST routes post-upgrade.

3. Long-term hardening.

   • Enforce least privilege on all REST endpoints; review permission callbacks across custom plugins.
   • Maintain a software bill of materials for WordPress plugins and monitor for advisories (WPScan, Patchstack, NVD).
   • Deploy WAF rules and rate limiting on API traffic; alert on abnormal enumeration patterns.
   • Implement centralized logging and detection (rules above) mapped to T1190.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-39794
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• WordPress REST API authentication and permission callbacks — https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
• WPScan vulnerability database (search: WooCommerce Multivendor Marketplace) — https://wpscan.com/

No CISA KEV entry, no public PoC, and no exploit-in-the-wild evidence or named threat actor campaigns are associated with CVE-2026-39794 at the time of writing.