CVE-2026-16038
Last modified
CVE-2026-16038 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MStore API | < 4.21.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-16038?
How severe is CVE-2026-16038?
How do I fix CVE-2026-16038?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-16027Server-Side request forgery (SSRF) vulnerability in Revenue …5.4
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before v…7.5
- CVE-2026-16030The MStore API WordPress plugin before 4.21.0 does not corr…8.1
- CVE-2026-16032The LWS Optimize WordPress plugin before 4.1.2 does not pro…6.1
- CVE-2026-16035The miniOrange 2FA WordPress plugin before 6.2.7 does not r…4.3
- CVE-2026-16036The miniOrange 2FA WordPress plugin before 6.2.7 does not b…7.5
- CVE-2026-16039The MStore API WordPress plugin before 4.21.0 does not rest…6.5
- CVE-2026-16041The MStore API WordPress plugin before 4.21.0 does not perf…7.5
- CVE-2026-16042The LWS Optimize WordPress plugin before 3.4 does not perfo…4.3
- CVE-2026-1605In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5,…7.5
- CVE-2026-16051The wpmudev-updates WordPress plugin before 5.0.1 does not v…
- CVE-2026-16053Zohocorp ManageEngine M365 Manager Plus and M365 Security Pl…8.5
Are you affected by CVE-2026-16038?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST