4.3
Medium
CVE-2026-97219 The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
Description
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MStore API 4.21 | 4.21.1 → < 4.22.1 | 4.22.1 |
Other CVEs of MStore API
The 12 CVEs of MStore API →
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Medium
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Medium
CVE-2026-16039
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own…
6.5
Medium
CVE-2026-16041
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
7.5
High