EUVD-2026-54388
GHSA-9px3-jf5v-3473
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network REST endpoint requires no authentication or interaction; I:H reflects unlimited, unconstrained fabrication of review content with complete subversion of the purchase-verification control.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
AnalysisAI
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to be simultaneously true: (1) the target WordPress installation must have MStore API plugin version prior to 4.21.0 installed and active; and (2) the WooCommerce store must have the 'accept reviews only from verified owners' setting enabled - without this setting, no authorization exists to bypass and the flaw has no meaningful security consequence. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-accessible, zero-authentication bypass with high integrity impact and no complexity barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a WooCommerce store running MStore API below 4.21.0 with verified-purchase reviews enabled, then uses the publicly available proof-of-concept to automate POST requests to the plugin's REST review endpoint, submitting fabricated 1-star reviews under invented names and email addresses without any account or prior purchase. Because the endpoint requires no authentication and imposes no rate-limiting by default, an attacker can programmatically flood multiple products with negative (or positive) reviews, directly manipulating displayed star ratings and undermining consumer trust at scale. |
| Remediation | Update MStore API to version 4.21.0 or later, which is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/0e7d8a17-0901-45b5-959c-2c1ef1316047/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress installations for the MStore API plugin, document current versions via the WordPress admin dashboard, and create full-site backups as a precaution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mstore Api
View allThe MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to uplo
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce
The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today