MStore API CVE-2026-16041

Exploitation requires two specific conditions to be simultaneously true: (1) the target WordPress installation must have MStore API plugin version prior to 4.21.0 installed and active; and (2) the WooCommerce store must have the 'accept reviews only from verified owners' setting enabled - without this setting, no authorization exists to bypass and the flaw has no meaningful security consequence. No attacker authentication is required (CVSS PR:N); the attack proceeds via a direct unauthenticated HTTP POST to the plugin's REST endpoint over the network with no user interaction (CVSS UI:N). Exploitation is strictly limited to review integrity manipulation - no customer payment data, session tokens, database credentials, or system resources are accessible through this vulnerability. Defenders can assess risk by checking whether both the plugin version and the WooCommerce review restriction setting are simultaneously present.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-accessible, zero-authentication bypass with high integrity impact and no complexity barriers. However, the EPSS score of 0.14% at the 3rd percentile stands in notable contrast - very low observed exploitation probability despite the public POC, suggesting attackers have not broadly targeted this vulnerability at time of analysis. SSVC classifies exploitation as automatable with partial technical impact, confirming that scripted, mass-fabrication of fake reviews is feasible but the blast radius is confined to review data rather than full system compromise. No KEV listing exists to confirm active exploitation. The gap between high CVSS and low EPSS likely reflects that the vulnerable population is bounded: only WooCommerce stores running this specific plugin with the verified-purchase restriction enabled are meaningfully exploitable. Real-world priority should be moderate - the attack is trivially automatable and the POC is public, but the harm is brand and credibility damage (manipulated star ratings) rather than data exfiltration, remote code execution, or system compromise.

An attacker discovers a WooCommerce store running MStore API below 4.21.0 with verified-purchase reviews enabled, then uses the publicly available proof-of-concept to automate POST requests to the plugin's REST review endpoint, submitting fabricated 1-star reviews under invented names and email addresses without any account or prior purchase. Because the endpoint requires no authentication and imposes no rate-limiting by default, an attacker can programmatically flood multiple products with negative (or positive) reviews, directly manipulating displayed star ratings and undermining consumer trust at scale.