EUVD-2026-68048
GHSA-jmq8-gg6r-m32f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable REST endpoint, low complexity, subscriber auth required (PR:L), no confidentiality or availability impact, only integrity.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
AnalysisAI
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress session at subscriber level or above - the attacker must have or be able to create a registered user account on the target site (common on public WooCommerce storefronts with open registration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the attack profile: network-reachable, low complexity, requiring only subscriber-level credentials, with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update MStore API to version 4.21.1 or later, which is the vendor-released patch per WPScan and NVD. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mstore Api
View allThe MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to uplo
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to cre
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today