CVE-2026-18233
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 29, 2026
- Updated
- Aug 30, 2026
- Reserved
- Jul 29, 2026
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
MStore APIUnknown |
|
References
- https://wpscan.com/vulnerability/241c0394-8dfa-475c-a91b-e2b5e47add53/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.