CVE-2026-16039

The CVE-2026-16039 affects the MStore API WordPress plugin prior to 4.21.0. The vendor-orders endpoint does not restrict access to the caller’s own orders, enabling any authenticated user (including Subscribers) to read all WooCommerce orders and associated customer personal information. Root cau...