6.5
Moyenne
CVE-2026-18234 The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MStore API 4.21 | premières → < 4.21.1 | 4.21.1 |
Autres CVE de MStore API
Les 12 CVE de MStore API →
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
4.3
Moyenne
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Moyenne
CVE-2026-16039
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own…
6.5
Moyenne
CVE-2026-16041
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
7.5
Élevée