Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-16039: MStore API < 4.21.0 - Unauthorized Access to Customer Data
CVE-2026-16039 · published 2 months ago
Summary
The MStore API WordPress plugin before version 4.21.0 has a security flaw that allows any authenticated user to view all customer orders and personal information. This is a serious issue because it could allow unauthorized access to sensitive customer data. To fix this, update the MStore API plugin to version 4.21.0 or later.
What to do
- Update unknown mstore api to version 4.21.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | mstore api | < 4.21.0 |
Original advisory text
MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published7 Aug 2026
Updated4 Nov 2026
First seen7 Aug 2026
Track software like this
Free during beta