Description

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-07T06:16:55.950Z",
  "pubdate": "2026-08-07T06:16:55.950Z",
  "executiveSummary": "An improper authorization and missing payment verification vulnerability exists within the MStore API WordPress plugin in versions prior to 4.21.0. The vulnerability resides in several payment-completion endpoints exposed by the plugin, which fail to cryptographically or programmatically verify transaction authenticity and settlement status with the underlying payment gateway before processing state transitions.\nThe primary impact of this flaw allows unauthenticated remote attackers to arbitrarily alter the status of any pending or created order to fully paid without executing any financial transaction. This enables malicious actors to acquire digital or physical goods and services for free, resulting in direct financial loss and inventory depletion for affected merchants.\nThe vulnerability affects all installations of the MStore API WordPress plugin prior to version 4.21.0. Exploitation requires no prior authentication, specific privileges, or user interaction, as the vulnerable endpoints are publicly accessible over the network via standard HTTP requests. Attackers can interact directly with the payment-completion endpoints by supplying arbitrary order identifiers.\nRisk implications are critical due to the ease of automated exploitation, lack of prerequisite access, and severity of the business impact. Mitigation requires updating the MStore API plugin to version 4.21.0 or later, where proper server-side payment gateway validation logic has been implemented.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and missing business logic controls within the payment-completion endpoints of the MStore API WordPress plugin. Specifically, the affected endpoints trust client-supplied data or lack mandatory server-to-server callbacks and API queries to verify that a transaction has been successfully authorized and settled by the third-party payment gateway.\nThe vulnerable components consist of the REST API or AJAX endpoints designed to finalize transactions within the MStore API plugin framework. These affected versions, specifically all releases prior to 4.21.0, process state-change requests for orders without enforcing authentication or validating transaction cryptographic signatures, tokens, or webhook verification keys provided by the payment gateway.\nThe attack flow proceeds as follows: First, an unauthenticated attacker initiates an order through the normal application workflow to obtain a valid target order ID, or alternately targets guessed or enumerated order identifiers. Second, the attacker crafts an HTTP request directed at the exposed payment-completion endpoints of the MStore API. Third, the attacker bypasses the actual payment gateway interaction entirely, omitting payment tokens or supplying fabricated parameters if necessary. Fourth, the MStore API backend receives the request, fails to query the payment gateway for transaction verification, and unconditionally executes the order status update function, transitioning the order state from pending to fully paid.\nBecause the endpoints are exposed over standard network protocols (HTTP/HTTPS) and require no authentication or session cookies, an attacker can script this process to mass-exploit orders. The post-exploitation impact includes unauthorized fulfillment of goods, depletion of stock, administrative overhead from fraudulent orders, and potential compromise of merchant revenue streams."
}