7.5
High
CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
Description
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MStore API 4.21 | earliest → < 4.21.0 | 4.21.0 |
Other CVEs of MStore API
The 12 CVEs of MStore API →
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
4.3
Medium
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Medium
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Medium
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used…
8.1
High