Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-81792
MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX — WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N L L 6.5 .0033 24.4 —
AFFECTED
Product Versions Fixed
Product Catalog Enquiry for WooCommerce by MultiVendorX unspecified 6.1.6
TIMELINE
Aug 27 Reserved by Patchstack
Sep 8 Published (CNA: Patchstack)
Oct 6 PATCH SHIPPED — CVE-2026-81792 (MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX). Fixed in Product Catalog Enquiry for WooCommerce by MultiVendorX 6.1.6.
Description
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 27, 2026 | Reserved | Reserved by Patchstack |
| September 8, 2026 | Published | Published (CNA: Patchstack) |
| October 6, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-81792 (MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX). Fixed in Product Catalog Enquiry for WooCommerce by MultiVendorX 6.1.6. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| MultiVendorX | Product Catalog Enquiry for WooCommerce by MultiVendorX | — | — | 6.1.6 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-81792 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
