MStore API CVE-2026-18234

Requires an authenticated WordPress session at subscriber level or above - the attacker must have or be able to create a registered user account on the target site (common on public WooCommerce storefronts with open registration). The MStore API plugin must be installed and active. No special plugin configuration or elevated role is needed beyond basic authentication. Exploitation is limited by the PR:L requirement: unauthenticated visitors cannot exploit this flaw. Additionally, the attacker must know or enumerate a valid target order ID, which is often trivial due to sequential WooCommerce order numbering. No user interaction from the victim or administrator is required.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the attack profile: network-reachable, low complexity, requiring only subscriber-level credentials, with high integrity impact. EPSS at 0.13% (3rd percentile) is low despite a publicly available exploit, suggesting exploitation remains limited or targeted rather than widespread - this is consistent with the PR:L requirement, which filters out unauthenticated mass scanning. There is no CISA KEV listing at time of analysis. The business impact, however, is disproportionate to the CVSS score for e-commerce operators: successful exploitation enables financial fraud - goods and services obtained without payment - which may cause direct monetary loss. Any WooCommerce store using this plugin that allows user registration should treat this as urgent regardless of low EPSS, since subscriber accounts are trivially obtainable on most public storefronts. No conflicting signals between CVSS and description: the PR:L requirement is consistent with the authenticated exploitation path described.

An attacker registers or already holds a subscriber-level account on a target WooCommerce store running MStore API. They identify the numeric order ID of a high-value order (order IDs are often sequential and guessable) belonging to another customer, then send a crafted REST API wallet payment request referencing that order ID. The plugin marks the order as paid without verifying ownership or deducting any balance, and the attacker can claim fulfillment of the order. A publicly available exploit exists per WPScan, lowering the technical bar.