CVE-2026-16038CWE-862broken-access-control

CVE-2026-16038

Critical · published August 7, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-07T10:16Z
References (1)
https://wpscan.com/vulnerability/6321d247-39c7-43a6-a528-202e1118a5d5/ · [email protected]
EPSS history
Timeline
  • 07 AUG 06:00Z
    MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
    cvelistv5