rootpwn

medium · CVSS v3 4.3 · EPSS 0.00185

CVE-2026-97219

The MStore API WordPress plugin (v<4.22.1) allows any authenticated user to change the status of their own unpaid orders to paid or fulfille

Overview

The MStore API WordPress plugin (v<4.22.1) allows any authenticated user to change the status of their own unpaid orders to paid or fulfilled. This can result in customers receiving goods without payment. The vulnerability is present in the order update endpoint.

Description

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

Impact

Confidentiality is not directly affected, but the integrity of order data is compromised, enabling fraudulent fulfillment. Availability is not impacted. Store owners and defenders are impacted as they may lose revenue and customer trust.

Remediation

Upgrade the MStore API plugin to version 4.22.1 or later. If an upgrade is not possible, restrict the order status update capability to administrators or implement role‑based checks. Monitor order status changes and audit logs for anomalous activity.

Risk context

The CVSS score of 4.3 indicates medium risk, and the EPSS of 0.00185 suggests low likelihood of exploitation. However, the potential loss of revenue and damage to customer trust warrant timely remediation.

Affected products

  • WordPress MStore API plugin

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
0.00185

WordPress plugin order-fraud authentication defense ecommerce integrity

← All CVEs

Related CVEs

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

View analysis

medium

CVE-2026-92551

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.

View analysis