CVE-2026-16039 in MStore API Plugin

Sumário

de MITRE • 07/08/2026

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsável: WPScan
• Reservar: 17/07/2026
• Divulgação: 07/08/2026
• Moderação: aceite
• Entrada: VDB-386931
• CPE: pronto
• CWE: CWE-639 (confirmado)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-16039
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16039
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-16039/