CVE-2026-16039

None

Open

TLP:CLEAR

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

Details

EPSS Score ⓘ: 0.20%

10.2th percentile
Confidence: 90%
Published: Aug 7, 2026
Last Modified: Aug 7, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.