CVE-2026-18234
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 29, 2026
- Updated
- Aug 30, 2026
- Reserved
- Jul 29, 2026
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
MStore APIUnknown |
|
References
- https://wpscan.com/vulnerability/1dc31c4e-9687-4056-a93e-9509c5a88828/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.