by Kastro
Paper/Archive/CVE-2026-16038

CVE-2026-16038

Unknown MStore API — MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.1.361 × 207.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

Affected

ProductAffectedFixed inSource
MStore API< 4.21.04.21.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/6321d247-39c7-43a6-a528-202e1118a5d5