CVE-2026-18233: MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. An attacker does not need payment credentials or ownership of the targeted order.

Q: What versions should be remediated?

MStore API versions before 4.21.1 are affected. Updating to version 4.21.1 or later addresses the affected version range.

Q: What is the impact if exploitation succeeds?

An authenticated attacker can use a delivery endpoint to mark arbitrary orders as completed and paid even when no payment was made.

Published Aug 29, 2026

Updated

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

Affected Software

1 affected component

WordPress MStore API<4.21.1

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. An attacker does not need payment credentials or ownership of the targeted order.

What versions should be remediated?

MStore API versions before 4.21.1 are affected. Updating to version 4.21.1 or later addresses the affected version range.

What is the impact if exploitation succeeds?

An authenticated attacker can use a delivery endpoint to mark arbitrary orders as completed and paid even when no payment was made.

CVE-2026-18233: MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions should be remediated?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions should be remediated?

What is the impact if exploitation succeeds?