CVE-2026-16041

Executive Summary

CVE-2026-16041 is an authorization bypass vulnerability in the MStore API WordPress plugin, affecting all versions prior to 4.21.0. The flaw resides in the REST API's product-review creation route, which fails to perform authorization or purchase-ownership checks, allowing unauthenticated attackers to inject fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings. This impacts any WooCommerce store running the vulnerable plugin, particularly those configured to accept reviews only from verified purchasers, undermining review integrity, eroding customer trust, and potentially enabling reputation manipulation or competitive sabotage.

Technical Analysis

The MStore API plugin is a widely used bridge between WooCommerce and mobile applications, exposing a REST API that permits mobile clients to interact with store functionality, including product reviews. The vulnerability is rooted in the plugin's REST route registration for creating product reviews, which incorrectly relies on the standard WordPress REST permission callback rather than implementing store-specific authentication and ownership validation.

Vulnerability Mechanism:

The affected route, typically registered under /wp-json/mstore/v1/add-review or similar, processes POST requests containing product ID, reviewer name, reviewer email, rating, and review content. The plugin fails to invoke wp_verify_nonce() or current_user_can() checks that would normally enforce a user to be logged in. More critically, it omits a validation step that confirms the authenticated (or unauthenticated) user has actually purchased the product being reviewed.

In WooCommerce, review submissions are gated by the woocommerce_review_rating_verification_required setting. When enabled, the platform only accepts reviews from customers with a verified purchase for that specific product. The MStore API plugin bypasses this gate entirely by accepting any POST request to its review-creation endpoint without cross-referencing WooCommerce order data for the submitting user.

Attack Surface:

• Endpoint: /wp-json/mstore/v1/* (REST API namespace)
• Authentication required: None
• Data exposure: Arbitrary review injection; no data exfiltration, but integrity compromise
• Prerequisite: Vulnerable plugin version installed and active

Code-Level Rationale:

WordPress REST API routes define permissions via the permission_callback argument. A common developer mistake, likely present here, is setting this callback to __return_true or omitting it entirely, which grants unconditional access. Additionally, the plugin's review handler reads reviewer name and email from the request body rather than from the authenticated user's profile, enabling spoofed identity creation.

Exploitation Scenarios

The following step-by-step attack chain demonstrates how an attacker exploits CVE-2026-16041:

1. Reconnaissance:

   • Attacker identifies target WooCommerce stores using the MStore API plugin via Shodan queries (http.component:"WordPress" http.title:"WooCommerce") or by probing /wp-content/plugins/mstore-api/readme.txt for version disclosure.
   • Attacker confirms the installed version is below 4.21.0.

2. Target Product Selection:

   • Attacker browses the target store's catalog and selects a product to attack—typically a high-margin item, a competitor's product, or a product the attacker wants to discredit.
   • Attacker notes the product's numeric ID (visible in URL, e.g., ?product_id=123).

3. Weaponization (Request Crafting):

   • Attacker crafts an unauthenticated HTTP POST request to the vulnerable endpoint:

     POST /wp-json/mstore/v1/add-review HTTP/1.1
     Host: target-store.com
     Content-Type: application/json
     
     {
       "product_id": 123,
       "reviewer_name": "Fake Customer",
       "reviewer_email": "fake@example.com",
       "rating": 1,
       "review": "Terrible product, broke after one day."
     }
     

   • No cookies, nonces, or authentication tokens are included.

4. Execution:

   • Attacker sends the request using curl, Burp Suite, or a simple Python script.
   • The plugin processes the request, creates a new WooCommerce review entry with status: approved (if auto-approve is enabled) or status: pending (if moderation is enabled), bypassing the verified-owner check.

5. Post-Exploitation Impact:

   • If auto-approval is enabled, the fake review appears instantly on the product page, damaging the product's rating. If pending, the attacker may spam hundreds of reviews to overwhelm moderators, increasing the chance of approval during moderation fatigue.
   • With identity spoofing, the attacker can impersonate real customers, high-profile users, or even legal entities, creating reputational harm.
   • The attacker can automate mass injection (e.g., 10,000 requests via a botnet) to rapidly alter a product's average star rating from 4.5 to 1.0, triggering automated "low-rated" flags or consumer abandonment.

Impact Assessment

Business Impact:

• Integrity compromise (HIGH): Product review integrity is fundamental to WooCommerce-driven revenue. Fabricated reviews directly manipulate consumer purchase decisions.
• Reputation damage (MEDIUM-HIGH): Store perceived as untrustworthy if review manipulation is discovered; competitors can weaponize this to sabotage rival stores.
• Operational overhead (MEDIUM): Manual review purging, order-verification audits, and customer support inquiries consume staff time.
• Regulatory/legal risk (LOW-MEDIUM): In some jurisdictions, fake reviews violate consumer protection laws (e.g., FTC guidelines in the US), exposing the store owner to liability even though the attacker caused the injection.

Affected Systems:

• All WordPress sites running MStore API plugin < 4.21.0.
• WooCommerce stores with woocommerce_review_rating_verification_required enabled are most severely impacted, as they explicitly signal trust in verified-owner reviews.

Blast Radius:

• CVSS score: N/A (not officially scored by NVD). The vulnerability is remotely exploitable without authentication, has low attack complexity, requires no user interaction, and affects system integrity only (no confidentiality or availability impact). An estimated CVSSv3.1 base score would be approximately 5.3 (Medium) under a standard CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N vector.
• No CISA KEV listing and no confirmed exploitation in the wild as of this report.

Detection Guidance

Sigma Rule

title: MStore API Plugin Unauthenticated Review Creation Attempt
id: 3f8c9b0a-7e2d-4f6a-9c1e-5d9b8a4f3c2a
status: experimental
description: Detects unauthenticated POST requests to MStore API review-creation endpoints, indicating potential exploitation of CVE-2026-16041.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16041
author: Valtersit Threat Intel Team
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'WordPress access logs with REST API access'
detection:
    selection_method:
        cs-method: POST
    selection_uri:
        cs-uri-query|contains:
            - '/wp-json/mstore/v1/add-review'
            - '/wp-json/mstore/v1/submit-review'
            - '/wp-json/mstore/v1/review'
    selection_auth:
        cs-uri-query|contains: 'mstore/v1'
    condition: selection_method and selection_uri and selection_auth
level: high
falsepositives:
    - Legitimate mobile app users submitting reviews through the app (if plugin does not require auth)
fields:
    - src_ip
    - cs-uri-query
    - cs-user-agent
tags:
    - attack.t1190
    - cve.2026-16041

YARA Rule

rule CVE_2026_16041_MStore_API_Unauthorized_Review {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects payloads targeting the MStore API review creation endpoint"
        cve = "CVE-2026-16041"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16041"
    strings:
        $endpoint1 = "/wp-json/mstore/v1/add-review"
        $endpoint2 = "/wp-json/mstore/v1/submit-review"
        $json_key_product = "product_id"
        $json_key_reviewer = "reviewer_name"
        $json_key_email = "reviewer_email"
        $json_key_rating = "rating"
        $json_key_review = "review"
        $http_post = "POST /"
    condition:
        uint16(0) == 0x0d0a and // CRLF in header
        any of ($endpoint*) and
        all of ($json_key_*) and
        $http_post
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS MStore API Unauthenticated Review Injection (CVE-2026-16041)";
    flow:established,to_server;
    http.method:POST;
    http.uri:contains "/wp-json/mstore/v1/";
    http.uri:contains "review";
    content:"product_id";
    http.client_body;
    content:"reviewer_email";
    http.client_body;
    distance:0;
    classtype:web-application-attack;
    reference:cve,2026-16041;
    sid:2026011601;
    rev:1;
    metadata:created_at 2026-01-15, updated_at 2026-01-15;
)

Elastic Detection

sequence by source.ip with maxspan=5m
    [network where event.type == "connection" and destination.port == 80]
    [http where
        http.request.method == "POST" and
        http.request.uri contains "/wp-json/mstore/v1/" and
        http.request.uri contains "review" and
        http.request.body.content contains "product_id" and
        http.request.body.content contains "reviewer_email"
    ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="*wp-json/mstore/v1*review*"
| search "product_id" AND "reviewer_email"
| eval is_authenticated=if(cookie!="", "yes", "no")
| where is_authenticated="no"
| stats count by src_ip, useragent, uri_path, _time
| sort - count

Wazuh OSSEC Rule

<group name="wordpress, mstore, cve-2026-16041,">
    <rule id="501125" level="12">
        <if_sid>31100</if_sid>
        <regex>POST /wp-json/mstore/v1/(add-review|submit-review|review)</regex>
        <regex>product_id.*reviewer_email</regex>
        <description>MStore API unauthenticated review injection attempt (CVE-2026-16041)</description>
        <group>attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed).

1. Immediate Mitigations (before patching):

   • Disable the MStore API plugin's review-creation functionality if plugin settings allow granular control. If not, disable the entire plugin temporarily.
   • If the plugin must remain active, implement a WAF (e.g., Cloudflare, ModSecurity) rule to block POST requests to /wp-json/mstore/v1/*review* paths.
   • Enable WooCommerce review moderation (Settings > Products > Reviews > "Reviews can only be left by verified owners" and "Reviews must be manually approved") to add a human review layer.

2. Patch/Upgrade Steps:

   • Upgrade the MStore API plugin to version 4.21.0 or later via WordPress Admin (Plugins > Installed Plugins > Update) or by downloading the latest release from the official WordPress plugin repository.
   • After upgrading, verify the update by checking the plugin's readme file (/wp-content/plugins/mstore-api/readme.txt) for version 4.21.0.
   • Clear any page caching (W3 Total Cache, WP Super Cache, etc.) to ensure updated plugin files are served.
   • Test the review endpoint with a non-authenticated POST request to confirm the patch rejects it.

3. Long-Term Hardening:

   • Implement a WordPress security plugin (e.g., Wordfence, Sucuri) that provides real-time REST API monitoring and rate-limiting on API endpoints.
   • Enforce least-privilege: restrict REST API access to authenticated users only where possible via .htaccess rules or a security plugin.
   • Regularly audit WordPress plugin versions against NVD and vendor advisories; establish a patch-management SLA (e.g., 48 hours for high-severity issues).
   • Monitor WooCommerce review tables (wp_comments with comment_type = 'review') for anomalous spikes or patterns (e.g., identical IPs, fake email domains, burst submissions).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16041
2. WordPress Plugin Repository (MStore API): https://wordpress.org/plugins/mstore-api/
3. WooCommerce Review Verification Documentation: https://woocommerce.com/document/setting-up-woocommerce-reviews/
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No listing for CVE-2026-16041 as of this report)
5. OWASP REST API Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html

Threat Actor Campaign Evidence: No active campaigns or exploit-in-the-wild evidence has been publicly reported at the time of this writing. The vulnerability is likely being probed by automated scanners targeting WooCommerce sites.