4.3
Moyenne
CVE-2026-97219 The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
Description
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MStore API 4.21 | 4.21.1 → < 4.22.1 | 4.22.1 |
Autres CVE de MStore API
Les 12 CVE de MStore API →
CVE-2026-18234
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
6.5
Moyenne
CVE-2026-18233
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
6.5
Moyenne
CVE-2026-16039
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own…
6.5
Moyenne
CVE-2026-16041
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
7.5
Élevée