CVE-2026-16041: Unknown Mstore API

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

Affected products

• Unknown Mstore API: before 4.21.0 (fixed in 4.21.0)

Published 2026-08-07. Last modified 2026-08-26.