Medium severity · published Aug 29, 2026
CVE-2026-18233
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MStore API ·
before 4.21.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18233
wpscan.com
https://wpscan.com/vulnerability/241c0394-8dfa-475c-a91b-e2b5e47add53/
More from MStore API
9.8
CVE-2023-3077
MStore API < 3.9.8 - Unauthenticated Blind SQLi
9.8
CVE-2023-3076
MStore API < 3.9.9 - Unauthenticated Privilege Escalation
9.1
CVE-2026-16038
MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
8.1
CVE-2026-16030
MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
7.5
CVE-2026-16041
MStore API < 4.21.0 - Unauthenticated Product Review Creation