CVE-2026-97219: MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MStore API WordPress pluginto a version that resolves this vulnerability.Fixed in 4.22.1
Event History
Frequently Asked Questions
Which deployments are exposed?
MStore API WordPress plugin versions before 4.22.1 are affected where users can self-register accounts and create unpaid orders. An authenticated customer can only alter their own order, but can mark it paid or fulfilled.
What access does an attacker need?
The attacker needs a valid authenticated account. Because self-registration is sufficient where enabled, no administrative or elevated WordPress role is required.
How can I determine whether exploitation may have occurred?
Review orders associated with customer accounts for unpaid orders whose status was changed to paid or fulfilled. Compare those status changes against payment records to identify orders released without a corresponding payment.
What should be done if an immediate upgrade is not possible?
Disable or restrict self-registration to reduce access to the affected order-update functionality. Review and manually validate order-status changes before releasing goods.