CVE-2026-16041

Deferred Deferred - Pending Action

Unauthenticated Review Creation in MStore API WordPress Plugin

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: WPScan

Description

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-16041

EUVD

EUVD-2026-54388

Affected Vendors & Products

Vendor	Product	Version / Range
mstore_api	mstore_api	to 4.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The MStore API WordPress plugin before version 4.21.0 has a flaw in its REST API that allows unauthenticated users to create WooCommerce product reviews without verifying ownership or authorization. Attackers can set any reviewer name, email, and star rating, bypassing store settings that restrict reviews to verified purchasers.

Detection Guidance

Check if the MStore API plugin version is below 4.21.0 by inspecting the WordPress plugin directory or using commands like 'wp plugin list' in WP-CLI. Monitor for unauthorized product reviews with suspicious reviewer names or emails.

Impact Analysis

This vulnerability allows attackers to post fake reviews on your WooCommerce store, potentially misleading customers and damaging your store's reputation. It bypasses purchase verification, enabling spam or malicious reviews even if your store restricts reviews to buyers.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized creation of product reviews. Unauthenticated attackers could manipulate reviews with fake reviewer details, which may lead to misinformation or fraudulent activities. This could violate data integrity and privacy principles under GDPR and HIPAA if user data is mishandled or if the reviews contain sensitive information.

Mitigation Strategies

Immediately update the MStore API plugin to version 4.21.0 or later. Review recent product reviews for unauthorized entries and remove any suspicious ones. Ensure your WooCommerce store settings restrict reviews to verified purchasers.

Hi! I’m here to help you understand CVE-2026-16041. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70