CVE-2026-16041— MStore API < 4.21.0 - Unauthenticated Product Review Creation
Quick assessment
Affected
Unknown MStore API
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在版本低于 4.21.0 的 MStore API WordPress 插件中，其 REST 产品评论创建接口未进行授权或购买所有权验证，导致未认证的攻击者可以在那些配置为仅接受已验证所有者提交评论的商店中，创建包含攻击者自定义的评论者姓名、电子邮件地址和星级评分的 WooCommerce 产品评论。
Possible ATT&CK Techniques 1 AI
T1133 · External Remote ServicesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | MStore API | < 4.21.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16041
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MStore API < 4.21.0 - Unauthenticated Product Review Creation
Source: CVE Program / CVE List V5
Vulnerability Description
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | MStore API | 0 ~ 4.21.0 | - |
|
II. Public POCs for CVE-2026-16041
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16041
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16041 (1)
-
🔗 MStore API < 4.21.0 – Unauthenticated Product Review Creation | CVE 2026-16041 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-07 · 21 CVEs total
| CVE-2026-15211 | 5.9 MEDIUM | Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Captur |
| CVE-2026-15148 | 5.3 MEDIUM | WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via I |
| CVE-2026-15239 | 5.3 MEDIUM | Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection B |
| CVE-2026-14205 | WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter | |
| CVE-2026-14943 | Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API | |
| CVE-2026-14331 | Subscribe2 < 10.46 - Reflected XSS via email Parameter | |
| CVE-2026-15032 | wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion | |
| CVE-2026-15215 | Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation | |
| CVE-2026-15214 | Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDO | |
| CVE-2026-15359 | Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite | |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | |
| CVE-2026-16030 | MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication | |
| CVE-2026-16039 | MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR | |
| CVE-2026-16038 | MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways | |
| CVE-2026-15361 | Content Views < 4.5 - Subscriber+ SQL Injection via preview_request | |
| CVE-2026-15386 | Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text | |
| CVE-2026-16262 | Estatik < 4.3.3 - Login CSRF | |
| CVE-2026-16263 | WP Maps < 4.9.7 - Subscriber+ Local File Inclusion | |
| CVE-2026-16265 | WP Maps < 4.9.7 - Subscriber+ Denial of Service | |
| CVE-2026-16258 | Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics RES |
IV. Related Vulnerabilities
Same product: MStore API
-
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-18234
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment By -
CVE-2026-18233
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion -
CVE-2026-27543
WordPress MStore API plugin <= 4.20.0 - Privilege Escalation -
CVE-2026-16039
MStore API < 4.21.0 - Subscriber+ Order and Customer PII Dis
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
V. Comments for CVE-2026-16041
No comments yet