CVE-2026-18233: MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
Published Aug 29, 2026
·Updated
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
Affected Software
1 affected component
WordPress MStore API<4.21.1
Event History
Aug 29, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. An attacker does not need payment credentials or ownership of the targeted order.
2
What versions should be remediated?
MStore API versions before 4.21.1 are affected. Updating to version 4.21.1 or later addresses the affected version range.
3
What is the impact if exploitation succeeds?
An authenticated attacker can use a delivery endpoint to mark arbitrary orders as completed and paid even when no payment was made.