CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
Unauthenticated attackers can bypass payment verification to mark orders as paid, obtaining goods or services for free.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16038?
CVE-2026-16038 is a critical vulnerability in Unknown MStore API, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Weakness: CWE-862
Which versions are affected by CVE-2026-16038?
How do I fix CVE-2026-16038?
No fix has been published for CVE-2026-16038 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-16038 exists.
Sources
Also known as GHSA-5xp8-jj53-535m.