Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-97219

MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress-extensions
Products
Mstore Api Mstore Api
CVE-2026-18233

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-18234

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16030

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16038

MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16039

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16041

MStore API < 4.21.0 - Unauthenticated Product Review Creation

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2021-47933

WordPress MStore API 2.0.6 Arbitrary File Upload

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Inspireui Mstore Wordpress
Products
Mstore Api Mstore Api Wordpress