CVE-2026-18234 — MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

CVE-2026-18234

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet PUBLISHED

Description (CNA)

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

Affected (CNA)

Vendor / product	Versions
Unknown / MStore API	affected 0 before 4.21.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1dc31c4e-9687-4056-a93e-9509c5a88828/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.