9.1
Critical
CVE-2026-16038 The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an…
Description
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MStore API 4.21 | earliest → < 4.21.0 | 4.21.0 |
Other CVEs of MStore API
The 12 CVEs of MStore API →
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
4.3
Medium
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Medium
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Medium
CVE-2026-16030
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used…
8.1
High