Security Alert Summary
The MStore API WordPress plugin (versions before 4.21.0) contains a payment verification flaw that allows an unauthenticated attacker to mark arbitrary orders as paid via several payment-completion endpoints. An attacker who exploits this behavior can obtain goods or services without completing a legitimate payment.
CVE Details
- CVE ID:
CVE-2026-16038 - Affected component: MStore API WordPress plugin
- Affected versions: Versions before 4.21.0
- Published: August 7, 2026 at 6:16:55 AM UTC
- Last modified: August 7, 2026 at 6:16:55 AM UTC
- CVSS v3.1 base score / severity / vector: Not provided in the CVE data
- Authentication / Privileges / User interaction: No authentication required; no privileges required; no user interaction required (unauthenticated attacker can trigger the issue as described)
- Primary impact: Integrity (order state can be forged/altered). Confidentiality: not reported. Availability: not reported.
- CWE / weakness ID: Not provided in the CVE data
Technical Details
According to the CVE description, the plugin does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints. Because the plugin fails to confirm the gateway’s payment status, an attacker can send requests to those endpoints that result in an order being recorded as fully paid without a successful payment transaction.
The vulnerability is located in the payment-completion flow of the plugin: the endpoints that finalize payment status lack the necessary verification step against the external payment gateway. The description does not name specific functions or REST endpoints, so no additional identifiers are available from the provided data.
Impact: an attacker who can reach the affected endpoints can cause the site to treat unpaid orders as paid, allowing the attacker to obtain goods or services without paying. The issue affects order integrity and transactional correctness; it does not, in the provided information, describe data disclosure, remote code execution, or site-wide privilege escalation.
How This Could Impact Your Website
Consider a small ecommerce site using the MStore API plugin: the site owner configures product sales, an internal staff member manages order fulfillment, and an external contractor handles product uploads. If the plugin’s payment-completion endpoints accept unauthenticated requests that mark orders as paid, an attacker could submit requests that cause the store to mark orders as paid. Internal staff might then fulfill those orders and ship products to addresses provided by the attacker, incurring direct financial loss and inventory depletion.
Practical consequences include incorrect order records, financial loss due to shipped goods, and increased exposure to targeted social engineering if attackers reuse information gathered from orders. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or other roles that can interact with order or payment plugins.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and extensions that interact with payments or order processing.
- Monitor site activity and order logs for unusual behavior, such as orders marked paid without corresponding gateway confirmations.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
