CVE-2026-16039 MStore API CVE debrief

Who should care

WooCommerce site owners and administrators, WordPress security teams, users of the MStore API plugin, and security teams responsible for vulnerability management and remediation efforts.

Technical summary

The MStore API WordPress plugin before 4.21.0 does not restrict access to its vendor-orders endpoint, allowing any authenticated user to read all WooCommerce orders and customer personal information. This can lead to unauthorized access to sensitive information, including customer data. The plugin's lack of access control allows Subscribers and other authenticated users to exploit this vulnerability. Defenders should verify and restrict access to the vendor-orders endpoint, limit access to sensitive order information, and monitor for unauthorized access attempts.

Defensive priority

Authenticated users can access sensitive order information; verify and restrict access to vendor-orders endpoint.

Recommended defensive actions

• Verify and restrict access to the vendor-orders endpoint
• Limit access to sensitive order information
• Monitor for unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information. Evidence is limited; defenders should verify affected versions, review access controls, and monitor for unauthorized access attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.