https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:01:38.072764+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349436 EUVD-2026-349436 2026-10-07T03:01:38.074897+00:00 EUVD-2026-349436 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16041 fkie_cve-2026-16041 2026-10-07T03:01:38.074928+00:00

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

 https://cve.radiocsirt.org/vuln/ghsa-9px3-jf5v-3473 GHSA-9px3-jf5v-3473 2026-10-07T03:01:38.074959+00:00

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.