MStore API CVE-2026-16038

Exploitation requires the target WordPress site to have the MStore API plugin installed and active at a version below 4.21.0 with WooCommerce checkout/payment flows enabled, and it targets the plugin's payment-completion endpoints specifically. Per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration required beyond having the vulnerable plugin handle orders - an attacker only needs a valid/created order ID to mark it paid. The main limiting factor is exposure scope: the store must actually be using the MStore API payment endpoints (typically to serve the MStore mobile app), and realized harm depends on the store auto-fulfilling on paid status rather than performing manual/gateway-side payment reconciliation.

Signals are largely aligned toward real risk but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates trivial remote unauthenticated exploitation with high confidentiality and integrity impact, and SSVC rates it Automatable=yes with Technical Impact=total, consistent with a scriptable order-marking abuse. Publicly available exploit code exists (WPScan) but this is not in CISA KEV, so exploitation is proof-of-concept, not confirmed in-the-wild. The tension is the EPSS score of just 0.14% (3rd percentile), which suggests low observed exploitation activity to date despite the easy, automatable nature - likely because impact is business/fraud-specific rather than server-compromising. The C:H rating is arguably generous for what is fundamentally a payment-integrity/business-logic flaw; the strongest concrete impact is integrity (forged paid orders) and financial loss, so treat CVSS as an upper bound. Net: a genuine priority for any live MStore/WooCommerce store transacting real money, patch promptly.

An attacker adds items to a cart on a store running MStore API < 4.21.0, then sends a crafted request directly to one of the payment-completion REST endpoints referencing their order ID, causing WooCommerce to mark the order as fully paid without any funds changing hands. The store then ships physical goods or releases digital downloads/licenses for free; because the flaw is automatable, this can be scripted across many orders. A public POC from WPScan lowers the skill barrier for this low-complexity, unauthenticated attack.