Authorization Bypass in MStore API Plugin for WordPress
CVE-2026-16041
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16041?
The MStore API plugin for WordPress, prior to version 4.21.0, lacks proper authorization checks on its REST endpoint for creating product reviews. This vulnerability allows unauthenticated attackers to submit product reviews to WooCommerce stores, impersonating any reviewer by specifying arbitrary reviewer names, emails, and star ratings. This exploit is particularly severe for stores that only accept reviews from verified owners, as it undermines the integrity and trust of the review system.
Affected Version(s)
MStore API 0 < 4.21.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.