CVE-2026-16038 carries a 9.1 CVSS score, but the EPSS score of 0.00136 tells a different story. This gap is the first thing to internalize: this is not a vulnerability that automated scanners will find and exploit at scale. Instead, it requires a targeted attacker with knowledge of how this specific plugin — MStore API, which handles WooCommerce mobile storefront orders — processes payment completion. The technical flaw is straightforward: the plugin does not verify payment status with the payment gateway before marking orders as paid, and this missing check exists across multiple endpoints. The CVSS captures the technical impact accurately, but it conflates severity with exploitability in a way that can mislead resource allocation decisions.
If you run this plugin, the priority question is not "how quickly can I patch" — it's "what is my specific gateway integration, and does the plugin actually verify callbacks from it?" The plugin's architecture appears to have assumed payment verification happened upstream, in the payment gateway itself, rather than treating the plugin as a point where verification must occur. That assumption is the real vulnerability, and patching specific endpoints addresses symptoms, not the underlying mental model. Check whether version 4.21.0 introduced centralized verification logic or simply hardened individual endpoints — if it's the latter, any future payment-completion endpoint added to the plugin carries the same implicit trust flaw.
The low EPSS score should not produce complacency. It reflects the reality that exploitation requires site-specific knowledge: understanding the target's WooCommerce order flow, payment gateway configuration, and mobile API routing. An attacker who understands MStore API's integration patterns has a template that works across every deployment. The risk is concentrated and surgical, not spray-and-pray. Monitor your order completion logs for anomalies — orders marked paid without corresponding gateway callbacks, unexpected order state transitions, or fulfillment of high-value orders that lack verification timestamps.
This is also the fourteenth CVE since 2018 in the WooCommerce payment integration space describing the same missing verification pattern. The recurrence indicates that patching endpoints individually without correcting the architectural assumption produces durable vulnerability — the pattern will recur in future plugin versions unless the codebase's fundamental trust model changes.