CVE-2026-16039
Last modified
CVE-2026-16039 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MStore API | < 4.21.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-16039?
How severe is CVE-2026-16039?
How do I fix CVE-2026-16039?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-16032The LWS Optimize WordPress plugin before 4.1.2 does not pro…6.1
- CVE-2026-16033A path traversal vulnerability in LXD allows an attacker to …8.5
- CVE-2026-16035The miniOrange 2FA WordPress plugin before 6.2.7 does not r…4.3
- CVE-2026-16036The miniOrange 2FA WordPress plugin before 6.2.7 does not b…7.5
- CVE-2026-16037Observable timing discrepancy vulnerability in PayTR Payment…7.5
- CVE-2026-16038The MStore API WordPress plugin before 4.21.0 does not veri…9.1
- CVE-2026-16041The MStore API WordPress plugin before 4.21.0 does not perf…7.5
- CVE-2026-16042The LWS Optimize WordPress plugin before 3.4 does not perfo…4.3
- CVE-2026-16044Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fa…5.4
- CVE-2026-16045Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Ma…4.3
- CVE-2026-16046Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fa…4.3
- CVE-2026-16047Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…4.3
Are you affected by CVE-2026-16039?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST