CVE-2026-16041

The affected component is the MStore API WordPress plugin (pre-4.21.0). The vulnerability arises from missing authorization/purchase-ownership checks on the REST product-review creation endpoint, enabling an unauthenticated attacker to submit WooCommerce product reviews with attacker-chosen revie...