CVE-2026-97219

The MStore API WordPress plugin before version 4.22.1 is vulnerable to a payment bypass due to a lack of restriction on which fields of an order a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or ...