CVE-2026-16039
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Risk Assessment
The risk includes customer privacy breach and exposure of sensitive personal data, potentially leading to legal consequences and loss of trust.
Recommendation
Update the MStore API plugin to version 4.21.0 or later. Also, restrict access to the vendor-orders endpoint to only the order owners.
Other vulnerabilities in MStore API
See all- CVE-2026-16038Critical
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
- CVE-2026-18234Low risk· EPSS 3%
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods. This allows any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
- CVE-2026-18233Low risk· EPSS 3%
The MStore API WordPress plugin before version 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester. This allows any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
- CVE-2026-27543High
Unauthenticated privilege escalation in MStore API versions up to 4.20.0. An attacker can elevate privileges without authentication.
- CVE-2026-16041High
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
- CVE-2026-16030High
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
- CVE-2026-57375Medium
The MStore API plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.18.4.
- CVE-2026-3568Medium
The MStore API plugin for WordPress up to version 4.18.3 has an IDOR vulnerability in the update_user_profile() function. An authenticated user with Subscriber access can modify arbitrary meta fields on their account, including sensitive ones like wp_user_level, without proper validation.
Original NVD description (English source)
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.