6.5
Medium
CVE-2026-18233 The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MStore API 4.21 | earliest → < 4.21.1 | 4.21.1 |
Other CVEs of MStore API
The 12 CVEs of MStore API →
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
4.3
Medium
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Medium
CVE-2026-16039
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own…
6.5
Medium
CVE-2026-16041
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
7.5
High