303 matches found
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
EUVD-2026-57938
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-27543
CVE-2026-27543 relates to the WordPress plugin “MStore API” (WordPress MStore API plugin) and is described as an unauthenticated privilege escalation affecting versions
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-27543 WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
PT-2026-71503
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Taylsec in WordPress Plugin MStore API versions = 4.20.0...
CVE-2026-16039
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...
CVE-2026-16041
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
CVE-2026-16041
The CVE-2026-16041 entry concerns the MStore API WordPress plugin prior to version 4.21.0. The REST endpoint used for creating product reviews lacks authorization and purchase-ownership checks, allowing an unauthenticated attacker to submit WooCommerce product reviews with arbitrary reviewer name...
CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...
CVE-2026-16030 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...
EUVD-2026-54388
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...
CVE-2026-16039
CVE-2026-16039 affects the MStore API WordPress plugin prior to 4.21.0. The vendor-orders endpoint does not restrict access to the caller’s orders, allowing any authenticated user (including Subscribers) to read every WooCommerce order and associated customer personal information. Root cause: imp...
CVE-2026-16038
Summary : CVE-2026-16038 affects the MStore API WordPress plugin prior to 4.21.0. The vulnerability arises because the plugin does not verify payment with the gateway on several payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order as fully paid and obtain ...
CVE-2026-16041 MStore API < 4.21.0 - Unauthenticated Product Review Creation
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...
CVE-2026-57375
CVE-2026-57375 describes a missing authorization weakness in the WordPress MStore API (plugin/mstore-api) up to version
CVE-2026-57375 WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through = 4.18.4...