CVE-2026-97219
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The MStore API WordPress plugin before 4.22.1 does not restrict which order fields a customer may update. Any authenticated user with a self-registerable account can change the status of their own unpaid order to a paid or fulfilled state and receive goods without paying.
Risk Assessment
An attacker can obtain goods without making payment, leading to financial losses and abuse of the ordering process.
Recommendation
Update the MStore API plugin to version 4.22.1 or later and verify that order update endpoints restrict modifiable fields and enforce proper authorization.
Other vulnerabilities in MStore API WordPress Plugin
See all- CVE-2023-3077Critical
The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.
- CVE-2023-3076Critical
The MStore API WordPress plugin before version 3.9.9 allows visitors to create user accounts with any role via its REST API endpoint. This is only exploitable if the site owner paid for access to the plugin's pro features.
- CVE-2023-3209Low
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- CVE-2023-3131Medium
The MStore API WordPress plugin before version 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Original NVD description (English source)
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS