362 matches found
CVE-2026-18234
The MStore API WordPress plugin (versions before 4.21.1 ) contains a vulnerability where it fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, the plugin fails to deduct the wallet balance for most payment methods. This allows any authenti...
EUVD-2026-68048
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...
CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...
WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Completion vulnerability
Subscriber+ Arbitrary Order Completion vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...
CVE-2026-18233
The MStore API WordPress plugin in versions before 4.21.1 is vulnerable to an authorization bypass. The plugin fails to verify that an order targeted by one of its delivery endpoints belongs to the requester. This flaw allows any authenticated user , including those with Subscriber privileges, to...
EUVD-2026-68047
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
CVE-2026-18233: Missing Authorization
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
PT-2026-83400
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...
CVE-2026-18234: Missing Authorization
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...
PT-2026-83399
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
WordPress MStore API plugin < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability
Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MStore API versions 4.21.0...
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
EUVD-2026-57938
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
CVE-2026-27543
CVE-2026-27543 relates to the WordPress plugin “MStore API” (WordPress MStore API plugin) and is described as an unauthenticated privilege escalation affecting versions
CVE-2026-27543 WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...