Description

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T06:16:56.167Z",
  "pubdate": "2026-08-07T06:16:56.167Z",
  "executiveSummary": "The MStore API WordPress plugin before version 4.21.0 suffers from an authorization bypass vulnerability affecting its REST product-review creation route.\nThis security flaw allows unauthenticated remote attackers to generate unauthorized WooCommerce product reviews, injecting arbitrary reviewer names, email addresses, and star ratings.\nThe vulnerability directly impacts WooCommerce-enabled WordPress environments where store configurations restrict product reviews exclusively to verified purchasers.\nThe primary risk implication is the integrity compromise of the store's reputation system, enabling malicious actors to manipulate product ratings and consumer trust without possessing valid purchase history.\nNo user authentication or privileges are required to exploit this vulnerability, lowering the barrier to entry for attackers targeting exposed REST API endpoints.\nExploitation relies on interacting directly with the vulnerable REST API route exposed by the plugin, bypassing standard WooCommerce verification controls.",
  "technicalDetails": "The root cause of the vulnerability lies in the MStore API plugin's failure to enforce proper authorization checks and purchase-ownership validation on its custom REST product-review creation route.\nIn standard WooCommerce deployments, product review submissions are subjected to strict validation rules, including verification of whether the submitting user has an actual purchase history for the respective product when configured to accept reviews only from verified owners.\nThe vulnerable component is the REST API endpoint implemented by the MStore API plugin for handling product-review creation prior to version 4.21.0.\nBecause the affected route lacks proper access controls and session validation, external entities can interact with the endpoint over the network without supplying valid credentials or proof of purchase.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the exposed REST route designated for product-review creation within the MStore API namespace. Second, the attacker crafts a malicious HTTP request containing arbitrary payload data, specifically designating custom values for the reviewer name, target email address, and star rating. Third, the attacker transmits this HTTP payload to the server. Finally, the vulnerable REST controller processes the input and inserts the review directly into the underlying database, entirely bypassing the native WooCommerce verification checks that enforce verified owner status.\nThe network exposure is global, as WordPress REST API endpoints are publicly accessible over HTTP/HTTPS by default.\nThe post-exploitation impact includes reputational damage, metric distortion, and the potential propagation of fraudulent or deceptive content across the affected e-commerce platform."
}