Mstore Api

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:mstore_api:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductMstore Api (227f689c-8d02-536c-9ed2-c8a826b81d8c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-16041 vulnerable 2026-09-16 04:32:57.046824 MStore API < 4.21.0 - Unauthenticated Product Review Creation
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Published: 2026-08-07T06:00:13.619Z
Updated: 2026-08-07T18:13:51.411Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-16038 vulnerable 2026-09-16 04:32:56.621553 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Published: 2026-08-07T06:00:13.250Z
Updated: 2026-08-07T18:06:42.205Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-16030 vulnerable 2026-09-16 04:32:56.532264 MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Published: 2026-08-07T06:00:13.059Z
Updated: 2026-08-07T17:39:59.872Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-16039 vulnerable 2026-09-16 04:32:56.320973 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Published: 2026-08-07T06:00:13.440Z
Updated: 2026-08-07T18:05:37.270Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-3209 vulnerable 2026-06-08 06:09:38.847401 MStore API < 3.9.7 - Settings Update via CSRF
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Published: 2023-07-10T12:41:04.575Z
Updated: 2024-11-08T18:21:41.341Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-3131 vulnerable 2026-06-08 06:09:38.636240 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-3077 vulnerable 2026-06-08 06:09:38.438389 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-3076 vulnerable 2026-06-08 06:09:38.436960 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-24148 vulnerable 2026-06-08 05:30:03.869101 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.