Unauthorized Access in MStore API Plugin for WordPress Affects WooCommerce Orders
CVE-2026-16039
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16039?
The MStore API WordPress plugin versions prior to 4.21.0 are vulnerable as it fails to enforce proper restrictions on its vendor-orders endpoint. This oversight permits any authenticated user, even those with lower privileges such as Subscribers, to access and read all WooCommerce orders in the store. The exposure of sensitive customer information poses significant risks, highlighting the need for immediate updates to mitigate unauthorized data access.
Affected Version(s)
MStore API 0 < 4.21.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.