CVE-2026-97219

MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

Affected

MStore API

CVSS v3.1 WPSCAN

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 8th percentile

Published

2026-10-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629/

References

• CVE Record
• NVD entry