Unknown Mstore API vulnerabilities

7 CVEs affecting Unknown Mstore API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97219, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16038, published 2026-08-07. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an…
CVE-2026-16030, published 2026-08-07. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who…
CVE-2026-16041, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create…
CVE-2026-16039, published 2026-08-07. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every…
CVE-2026-97219, published 2026-10-02. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status…
CVE-2026-18234, published 2026-08-29. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment…
CVE-2026-18233, published 2026-08-29. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including…