CVE-2026-16039 — MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

CVE-2026-16039

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR PUBLISHED

Description (CNA)

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

Affected (CNA)

Vendor / product	Versions
Unknown / MStore API	affected 0 before 4.21.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/85c6ff37-4761-420c-970f-05b2c50d3b28/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.