CVE-2026-16039 in MStore API Plugininformación

Resumen

por MITRE • 2026-08-07

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

WPScan

Reservar

2026-07-17

Divulgación

2026-08-07

Moderación

aceptado

Artículo

VDB-386931

CPE

listo

EPSS

0.00000

KEV

no

Actividades

muy bajo

Sector

Hostingprovider

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-16039
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-16039
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-16039/

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!