CVE-2026-16039

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0

Description The MStore API WordPress plugin contains an Insecure Direct Object Reference (IDOR) flaw. This occurs because the '/vendor-orders' endpoint does not restrict access to the caller's own orders. Consequently, any authenticated user, including those with Subscriber privileges, can access all WooCommerce orders in the store, leading to the disclosure of customers' personal information.

Recommendations Update MStore API to version 4.21.0 or later. Restrict access to the '/vendor-orders' endpoint as a temporary mitigation measure.