CVE-2026-97219 — MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

CVE-2026-97219

MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter PUBLISHED

Description (CNA)

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / MStore API	affected 4.21.1 before 4.22.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.