Skip to content
Sign in
6.5 Medium

CVE-2026-18234 The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…

Description

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

Affected products and versions

Product Affected versions Fixed in
MStore API 4.21 earliest → < 4.21.1 4.21.1

Other CVEs of MStore API

The 12 CVEs of MStore API →
CVE-2026-97219 The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing… 4.3 Medium CVE-2026-18233 The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery… 6.5 Medium CVE-2026-16039 The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own… 6.5 Medium CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST… 7.5 High
Track this CVE