CVE-2026-16038

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

Score

CVSS 3.1 9.1 Critical

Status

Deferred - contact@wpscan.com

Published

2026-08-07

Last modified

2026-08-07

Weaknesses

CWE-862

Affected products

• Mstore Api (Unknown)

References

• https://wpscan.com/vulnerability/6321d247-39c7-43a6-a528-202e1118a5d5/