WordPress Plugin Vulnerabilities

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

Description

The plugin does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

Proof of Concept

Affects Plugins

Plugin icon
mstore-api
Fixed in 4.21.1

References

CVE
CVE-2026-18233

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
241c0394-8dfa-475c-a91b-e2b5e47add53

Timeline

Publicly Published
2026-08-27 (about 2 days ago)
Added
2026-08-27 (about 1 day ago)
Last Updated
2026-08-27 (about 1 day ago)

Other

Published
Title
Published
2026-02-18
Title
NM Gift Registry and Wishlist Lite < 5.14 - Missing Authorization
Published
2025-11-24
Title
Ace Post Type Builder < 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter
Published
2025-01-14
Title
NitroPack < 1.17.6 - Subscriber+ Limited Options Update
Published
2024-08-28
Title
WP Accessibility Helper < 0.6.2.9 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Published
2025-11-20
Title
Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO < 2.4.8 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update