7.5
Élevée
CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
Description
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MStore API 4.21 | premières → < 4.21.0 | 4.21.0 |
Autres CVE de MStore API
Les 12 CVE de MStore API →
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
4.3
Moyenne
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Moyenne
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Moyenne
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used…
8.1
Élevée