MStore API CVE-2026-18233

Exploitation requires a valid WordPress account at Subscriber level or higher on the target site - confirmed by CVSS PR:L, meaning unauthenticated exploitation is not possible. Sites that allow open user self-registration are at greatest risk, as an attacker can trivially create a qualifying account. The MStore API plugin must be installed and active in a version prior to 4.21.1, and the site must operate a WooCommerce store with existing orders. No non-default configuration is required - any default installation of the vulnerable plugin version is exploitable once an account exists. Exploitation is limited by the need for a valid account: sites that disable public registration or restrict new accounts significantly raise the attack bar. Order ID enumeration (often sequential in WooCommerce) is an additional prerequisite to targeting specific orders.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately reflects the core risk profile: network-accessible, low-complexity attack requiring only a low-privilege account, with high integrity impact and no confidentiality or availability effect. The Integrity:High rating is well-justified - fraudulently marking orders as paid directly harms merchants financially. For any e-commerce site running the vulnerable plugin, the real-world threat is significant: any registered WordPress user (subscriber or above) can exploit this, and WooCommerce order IDs are often sequential and therefore enumerable. The EPSS of 0.13% at the 3rd percentile is notably low, contrasting with the public POC availability; this suggests exploitation remains targeted or opportunistic rather than automated and widespread. The vulnerability is not in CISA KEV, which is consistent with the low EPSS. Defenders should not dismiss this based on EPSS alone - the low privilege bar and public POC make it a realistic fraud vector for any site that allows open user registration.

An attacker registers a free WordPress subscriber account on a WooCommerce store running the vulnerable MStore API plugin, then enumerates sequential order IDs (common in WooCommerce default configurations) belonging to other customers. The attacker sends a crafted authenticated API request to the delivery endpoint specifying a target order ID, which the plugin marks as completed and paid without any payment verification. A public POC is available, meaning this attack requires minimal technical skill to execute.