CVE-2026-16039

Executive Summary

CVE-2026-16039 is an Insecure Direct Object Reference (IDOR) vulnerability in the MStore API WordPress plugin, affecting all versions prior to 4.21.0. The flaw resides in the vendor-orders endpoint, which fails to enforce ownership-based access controls, allowing any authenticated user (including low-privileged Subscribers) to enumerate and retrieve every WooCommerce order in the store, along with associated customer Personally Identifiable Information (PII). The vulnerability carries a CVSS base score of 6.5 (Medium severity) and presents a significant confidentiality risk to e-commerce operations, exposing full order histories, billing details, shipping addresses, phone numbers, and other sensitive customer data to unauthorized parties.

Technical Analysis

The MStore API plugin bridges WordPress/WooCommerce installations with mobile applications, exposing a REST-style API surface that mobile clients consume. The vulnerable endpoint, located in the vendor-orders functionality, processes authenticated requests from the mobile app to fetch order details for store vendors.

The core vulnerability stems from a missing authorization check within the endpoint handler. When the plugin processes a request to the vendor-orders endpoint, it authenticates the user (verifying they hold a valid WordPress session or API token) but does not validate that the orders being requested belong to that user. The endpoint accepts an order identifier (or a set of identifiers) directly from the request parameters without verifying ownership relationships against the vendor/user account making the call.

From a code-level perspective, the flaw is typical of IDOR vulnerabilities: the handler likely executes a database query using user-supplied input (e.g., order_id, order_ids, or a range-based query) without joining against a vendor-to-order mapping table. The application thus relies on trust in the caller rather than enforcing server-side authorization. An authenticated Subscriber—a role that normally has no e-commerce capabilities—can exploit this by iterating through order identifiers, retrieving complete order objects.

The affected attack surface includes any WooCommerce store running the MStore API plugin before version 4.21.0. The vulnerability is network-exploitable (AV:N), requires low attacker privileges (PR:L — a valid Subscriber account), and does not require user interaction (UI:N). The impact is strictly confidentiality-oriented (C:H), with no integrity or availability impact. The related CWE is CWE-639 (Authorization Bypass Through User-Controlled Key).

Given the WordPress ecosystem's prevalence of shared hosting and the ease of escalating from Subscriber to data access, this vulnerability poses a realistic and practical threat to online merchants. The API endpoint is accessible through the WordPress REST API surface, making it trivially reachable by external attackers possessing valid subscriber credentials.

Exploitation Scenarios

A realistic attack chain for CVE-2026-16039 proceeds as follows:

1. Reconnaissance and Account Acquisition — The attacker first identifies a WooCommerce store running the MStore API plugin. This can be achieved via Shodan/Censys searching for exposed WordPress APIs or by fingerprinting the plugin through its API routes. The attacker then obtains Subscriber-level credentials. This is commonly done through: (a) registering a new account on a store that allows open user registration, (b) obtaining leaked credentials for an existing low-privilege account, or (c) exploiting a secondary, lower-severity vulnerability to create a Subscriber account.

2. Token/Session Establishment — The attacker authenticates against the WordPress site, obtaining a valid session cookie or a WooCommerce API token. Using the MStore API's authentication flow, the attacker obtains an application-specific token tied to the Subscriber account. Example authentication request: POST /wp-json/api/flutter_user/register or /wp-json/api/flutter_user/login, retrieving an auth token.

3. Endpoint Trigger and Enumeration — With the valid token, the attacker crafts HTTP requests to the vulnerable vendor-orders endpoint. The request structure targets the order-fetching route. A typical request might be: GET /wp-json/api/vendor_orders/get_vendor_orders?token=[SUBSCRIPTION_TOKEN]&order_id=1. The attacker iterates the order_id parameter sequentially (1, 2, 3, ...) or uses a range parameter such as ?from=1&to=1000 if supported.

4. Data Exfiltration — Each response returns a full order object in JSON format, containing: customer's full name, billing and shipping addresses, phone number, email address, ordered items, payment method, order status, and potentially masked credit card information or transaction IDs. The attacker scripts the enumeration loop to collect thousands of orders, exfiltrating complete customer PII databases from the store.

5. Post-Exploitation Impact — Stolen PII enables further attacks: targeted phishing campaigns based on purchase histories, credential stuffing using reused passwords and email addresses, social engineering against store customers, and even blackmail. Additionally, the aggregated order data may be sold on underground data markets.

The vulnerability is classified with POC_STATUS: Public, meaning exploit techniques and conceptual proof-of-concept code are publicly discussed. No Metasploit module or Nuclei template exists, but the exploitation mechanics are straightforward IDOR enumeration.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Score 6.5) highlights the confidentiality-focused impact. The high confidentiality sub-score (C:H) reflects the exposure of complete customer PII and order records.

Business Impact:

• Regulatory Non-Compliance — Stores operating under GDPR, CCPA, or PCI DSS face substantial fines for exposing customer PII. A breach of this nature is a reportable data breach.
• Brand and Customer Trust — A public disclosure of mass customer data leakage severely damages merchant reputation and erodes buyer confidence.
• Financial Loss — Beyond regulatory fines, costs include forensic investigation, customer notifications, credit monitoring services, and potential class-action lawsuits.
• Competitive Intelligence Leakage — Order volumes, pricing data, and inventory details exposed to unauthorized parties reveal sensitive business operations.

Affected Systems:

• All WooCommerce stores running MStore API versions below 4.21.0.
• Estimated blast radius: The plugin claims tens of thousands of active installations, with a large concentration in small-to-medium e-commerce businesses that often lack dedicated security teams.

Blast Radius: Any user with a Subscriber-level account on an affected installation can enumerate the entire order table. On stores with open registration, this effectively makes the vulnerability exploitable by any visitor.

Detection Guidance

The following detection rules focus on abnormal API request patterns characteristic of IDOR enumeration: rapid sequential requests to the vendor-orders endpoint from a single authenticated user, high volume of order-retrieval calls exceeding normal vendor activity, and unusual access patterns from Subscriber-role accounts.

Sigma Rule

title: MStore API Vendor Orders IDOR Enumeration
id: c1e2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects enumeration attempts against MStore API vendor-orders endpoint by low-privileged users
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-uri-extension: "vendor_orders"
    cs-method: "GET"
    sc-status: 200
  filter_users:
    cs-username|contains:
      - "administrator"
      - "shop_manager"
      - "vendor"
  condition: selection and not filter_users
  timeframe: 5m
  condition_aggregation:
    - query: "count(*) > 50"
      group-by: ["src_ip", "cs-username"]
level: high
falsepositives:
  - Legitimate mobile app users with misconfigured roles
  - Stores with high-volume vendor operations
tags:
  - attack.t1190
  - cve.2026-16039
  - cwe.639

YARA Rule

rule MStore_API_Order_Enumeration_IDS {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects exploit patterns for CVE-2026-16039 in HTTP logs and packet captures"
        date = "2026-01-25"
        cve = "CVE-2026-16039"
    strings:
        $ep1 = "vendor_orders" ascii nocase
        $ep2 = "get_vendor_orders" ascii nocase
        $param1 = "order_id=" ascii nocase
        $param2 = "from=" ascii nocase
        $param3 = "to=" ascii nocase
        $json = "\"billing_address\"" ascii nocase
        $json2 = "\"customer_email\"" ascii nocase
        $token = "token=" ascii nocase
    condition:
        any of ($ep*) and any of ($param*) and ($json or $json2) and $token
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"MStore API CVE-2026-16039 Order Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"vendor_orders"; nocase; http.uri; content:"order_id"; nocase; threshold:type both, track by_src, count 20, seconds 60; reference:cve,2026-16039; classtype:attempted-info-leak; sid:2026016039; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=30s
  [http where http.request.method == "GET" and http.request.uri.text contains "vendor_orders"] by http.request.uri.text
  [http where http.request.method == "GET" and http.request.uri.text contains "order_id" and http.request.uri.text like "*order_id=*"] by http.request.uri.text

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*/wp-json/api/vendor_orders*"
| stats count by src_ip clienthost user
| where count > 20
| eval severity="HIGH"
| table _time src_ip clienthost user count
| sort - count

Wazuh OSSEC Rule

<group name="web, MStore_API, IDOR,">
  <rule id="105469" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>vendor_orders</match>
    <regex>GET \S+vendor_orders\S+order_id=\d+</regex>
    <description>MStore API vendor_orders endpoint accessed. Potential IDOR exploitation (CVE-2026-16039).</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD description states the vulnerability exists "before 4.21.0," indicating a patched version (4.21.0+) exists, though this has not been independently verified by our team as of this writing. The vendor (InspireUI) has not published an advisory detailing the exact fix.

1. Immediate Mitigations (No Patch Deployed)

• Disable Open Registration: If the store allows public user registration, temporarily disable it to reduce the available attack surface of authenticated low-privilege users.
• Role Limiting: Immediately review all Subscriber-level accounts and revoke any that are not actively needed. Implement strict account approval workflows.
• Web Application Firewall (WAF): Deploy WAF rules to block/monitor anomalous requests to the /wp-json/api/vendor_orders endpoint, particularly those with sequential order_id parameters.
• Network Segmentation: If feasible, restrict API access to trusted mobile application IP ranges using firewall rules (note: mobile user IPs vary, so this is not a full mitigation).

2. Patch and Upgrade Steps

• Upgrade Immediately: Update the MStore API plugin to version 4.21.0 or later via the WordPress admin dashboard (Plugins → Installed Plugins → MStore API → Update Now) or by downloading the latest package from the official WordPress plugin repository.
• Verify Patch: After upgrading, re-test the vendor-orders endpoint with a Subscriber account. Confirm that the endpoint no longer returns orders belonging to other customers. Ensure the plugin vendor (InspireUI) has officially confirmed the fix.
• Post-Upgrade Audit: Review web server logs for any prior exploitation attempts or unusual API activity, and investigate any blocks of customer data that may have been accessed.

3. Long-Term Hardening

• Security Plugin: Install a WordPress security plugin (e.g., Wordfence, Sucuri) that provides virtual patching for known plugin vulnerabilities.
• Least Privilege: Audit all WooCommerce roles. Ensure that Subscriber accounts have no API access beyond what is strictly necessary.
• Regular Update Cadence: Subscribe to the WordPress Security Mailing list and plugin changelogs to stay aware of security fixes as they are released.
• Data Protection: Encrypt sensitive customer data at rest using appropriate WordPress security plugins and ensure databases are backed up securely.
• Monitoring: Implement continuous API request monitoring and set alerts for abnormal order-fetching patterns from any single account.

References

1. NVD Entry for CVE-2026-16039 — https://nvd.nist.gov/vuln/detail/CVE-2026-16039
2. WordPress Plugin Repository (MStore API) — https://wordpress.org/plugins/mstore-api/
3. WPScan (WordPress Vulnerability Research Database) — https://wpscan.com/plugin/mstore-api/
4. Wordfence Intelligence — https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/
5. OWASP IDOR (CWE-639) — https://owasp.org/www-community/attacks/Insecure_Direct_Object_References

Threat Actor Campaigns: As of the publication date of this report, no known threat actor campaigns or confirmed in-the-wild exploitation of CVE-2026-16039 have been publicly documented. The vulnerability is NOT present on the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the public PoC status and the relatively trivial nature of IDOR exploitation, we assess the likelihood of exploitation in the near term as elevated, particularly when automated scanning tools incorporate this CVE.