Unauthorized Order Completion in MStore API WordPress Plugin
CVE-2026-18233
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18233?
The MStore API WordPress plugin prior to version 4.21.1 contains a critical flaw that allows authenticated users, including those with subscriber roles, to manipulate order statuses. Specifically, the plugin does not adequately verify whether the orders accessed through its delivery endpoints belong to the requestor. This allows malicious users to complete and mark any order as paid without having made any actual payments, leading to potential financial losses and undermining the integrity of the e-commerce operations.
Affected Version(s)
MStore API 0 < 4.21.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.