EUVD-2026-54387
GHSA-wgmj-93jg-87w3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible BOLA requiring only Subscriber-level authentication; confidentiality-only impact as orders are read but not modified or deleted.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
AnalysisAI
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce order and associated customer PII to any authenticated WordPress user, including low-privileged Subscribers. The vendor-orders endpoint performs no caller-scoping check, meaning a Subscriber can enumerate the entire store's order history. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated WordPress session at Subscriber level or higher - the lowest role available after user registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) accurately characterizes the attack profile: network-accessible, low complexity, requiring only low-privileged authentication - any valid WordPress account including Subscribers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available exploit exists per WPScan (https://wpscan.com/vulnerability/85c6ff37-4761-420c-970f-05b2c50d3b28/). An attacker registers a free Subscriber account on the target WooCommerce store, authenticates to the WordPress REST API, and issues a GET request to the /vendor-orders endpoint without additional parameters. … |
| Remediation | Upgrade MStore API to version 4.21.0 or later, where the vendor-orders endpoint has been patched to enforce caller-scoped authorization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mstore Api
View allThe MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to uplo
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to cre
The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today