CVE-2026-16039 in MStore API Plugin
Summary
by MITRE • 08/07/2026
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in the MStore API WordPress plugin affects versions prior to 4.21.0 and represents a critical access control flaw that undermines the security of e-commerce operations. This issue stems from improper authorization checks within the vendor-orders endpoint, which should logically restrict order data access to authenticated users based on their ownership or role permissions. The flaw allows any authenticated user regardless of their role level to retrieve comprehensive order information including customer personal data, effectively bypassing the intended security boundaries that should separate different user categories.
The technical implementation of this vulnerability demonstrates a classic lack of proper access control mechanisms where the plugin fails to validate whether the requesting user has legitimate authorization to view specific order records. This represents a violation of the principle of least privilege and can be categorized under CWE-285, which addresses improper authorization in software systems. The flaw operates at the application layer and specifically targets the API endpoint responsible for retrieving vendor order information, making it particularly dangerous as it exposes sensitive customer data to unauthorized parties within the WordPress ecosystem.
From an operational perspective, this vulnerability creates significant risks for businesses using WooCommerce and the MStore API plugin, as it enables unauthorized access to potentially thousands of customer records including personal information such as names, addresses, email addresses, and purchase histories. The impact extends beyond simple data exposure since this information could be leveraged for identity theft, social engineering attacks, or targeted marketing fraud. Attackers with subscriber-level accounts could systematically harvest customer data, making this vulnerability particularly attractive for malicious actors seeking to monetize personal information. The breach affects compliance with privacy regulations such as gdpr and ccpa, potentially resulting in substantial legal and financial penalties for affected organizations.
The exploitation of this vulnerability aligns with several tactics described in the attack framework, particularly those involving credential compromise followed by privilege escalation through API misuse. This flaw represents a low-effort, high-impact attack vector that requires minimal technical expertise to exploit effectively, making it attractive to threat actors across different skill levels. Organizations should consider implementing immediate mitigations including updating to version 4.21.0 or later, reviewing user role assignments, and monitoring for unusual API access patterns. Additionally, implementing proper input validation and access control checks at the application level, combined with regular security audits of third-party plugins, can help prevent similar vulnerabilities from emerging in other components of the WordPress ecosystem. The remediation process should also include reviewing existing order data access logs to identify any potential unauthorized access that may have already occurred.