Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: MStore API 4.21.0 Clear all filters
TI-2026-13424 CVE-2026-16041 · GHSA-9px3-jf5v-3473

MStore API < 4.21.0 - Unauthenticated Product Review Creation

Priority HIGH 72

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product revi…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00358 Published 2026-08-07 Fixed in 4.21.0 CWE-862
TI-2026-13423 CVE-2026-16039 · GHSA-wgmj-93jg-87w3

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

Priority MEDIUM 62

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0034 Published 2026-08-07 Fixed in 4.21.0 CWE-639
TI-2026-13422 CVE-2026-16038 · GHSA-5xp8-jj53-535m

MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

Priority HIGH 80

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to m…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00418 Published 2026-08-07 Fixed in 4.21.0 CWE-862