A critical authorization flaw in the MStore API WordPress plugin allows unauthenticated attackers to inject unauthorized product reviews into WooCommerce stores.

The vulnerability exists within the REST product-review creation route, which lacks necessary capability checks. This allows an unauthenticated attacker to bypass verification requirements and submit reviews with arbitrary names, email addresses, and ratings.

Successful exploitation of this vulnerability compromises the integrity of customer feedback systems. An attacker can manipulate product ratings to deceive potential customers or damage the reputation of the business by flooding the store with fraudulent content. Given the high CVSS score, this flaw presents a significant risk to the trustworthiness of the e-commerce platform and requires immediate attention to prevent brand damage.

Immediate Action: Update the MStore API plugin to version 4.21.0 or later immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review WooCommerce product review logs for suspicious patterns, such as a high volume of reviews submitted within a short timeframe or reviews containing unusual metadata.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect REST API requests to the affected endpoint, blocking unauthorized attempts to interact with the review creation route.

Public Exploit Available: Unknown.

The ability for unauthenticated actors to bypass store review policies poses a direct threat to e-commerce operations. Security teams must prioritize updating the MStore API plugin to version 4.21.0 to close the identified security gap. Failure to apply this patch leaves the storefront vulnerable to automated abuse and reputation manipulation.