WordPress Plugin Vulnerabilities

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

Description

The plugin does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

Proof of Concept

Affects Plugins

Plugin icon
mstore-api
Fixed in 4.21.0

References

CVE
CVE-2026-16039

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Sai Praneeth Koti
Submitter
Sai Praneeth Koti
Verified
Yes
WPVDB ID
85c6ff37-4761-420c-970f-05b2c50d3b28

Timeline

Publicly Published
2026-08-03 (about 5 days ago)
Added
2026-08-03 (about 4 days ago)
Last Updated
2026-08-03 (about 4 days ago)

Other

Published
Title
Published
2023-04-03
Title
WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Published
2023-07-07
Title
Getnet Argentina para Woocommerce < 0.0.5 - Unauthenticated Authorization Bypass
Published
2025-10-17
Title
Event Tickets and Registration < 5.26.6 - Unauthenticated Ticket Payment Bypass
Published
2026-01-15
Title
Membership Plugin – Restrict Content < 3.2.17 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure