CVE-2026-16039
Received Received - Intake

Unauthorized Order Data Exposure in MStore API WordPress Plugin

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: WPScan

Description
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-16039
EUVD
EUVD-2026-54387

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mstore_api plugin to 4.21.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the MStore API WordPress plugin before version 4.21.0. It allows authenticated users, including those with Subscriber-level access, to access and view all WooCommerce orders in the store, exposing sensitive customer personally identifiable information (PII).

Detection Guidance

To detect this vulnerability, check the installed version of the MStore API plugin in your WordPress site. If the version is below 4.21.0, the system is vulnerable. You can verify this via the WordPress admin panel under Plugins or by querying the database for the plugin version.

Impact Analysis

This vulnerability allows unauthorized users to read all customer orders and personal data, potentially leading to data breaches, privacy violations, and misuse of sensitive information such as names, addresses, and payment details.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires strict protection of personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the MStore API plugin to version 4.21.0 or later. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review all customer order data accessed during the vulnerable period for potential exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16039. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart