AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-16038

CRITICAL · CVSS 9.1 EPSS 0.24%

Source: NVD + CISA KEV + EPSS · Published 2026-08-07 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The MStore API WordPress plugin prior to version 4.21.0 is vulnerable as it fails to verify payment transactions with the payment gateway before marking orders as paid, enabling unauthenticated attackers to exploit this flaw. This could lead to unauthorized access to goods or services without payment. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-16038
Severity
CRITICAL
CVSS
9.1
EPSS
0.24%
WordPress

Original NVD Description

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.