CVE-2026-16039 — MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, t…
Published: 2026-08-07 · CVSS: 6.5 · CVSS 3.1
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7