CVE-2026-16041 — MStore API < 4.21.0 - Unauthenticated Product Review Creation
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated…
Published: 2026-08-07 · CVSS: 7.5 · CVSS 3.1
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7