Description

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T06:16:56.060Z",
  "pubdate": "2026-08-07T06:16:56.060Z",
  "executiveSummary": "The MStore API WordPress plugin before version 4.21.0 suffers from an improper access control vulnerability within its vendor-orders endpoint. This flaw permits unauthorized retrieval of sensitive data by failing to enforce proper authorization checks ensuring that the caller can only access their own orders. The vulnerability allows any authenticated user, including those with low-privilege roles such as Subscribers, to programmatically query and read every WooCommerce order processed by the store. The resulting data exposure includes highly sensitive customer Personally Identifiable Information (PII) associated with each transaction, introducing severe privacy and compliance risks. The attack requires active authentication to the WordPress instance, but no advanced privileges beyond the baseline Subscriber role. Threat actors can systematically harvest order histories, financial transaction details, and customer contact data, leading to severe data breaches and potential privacy regulation violations. Remediation requires updating the MStore API plugin to version 4.21.0 or later, where proper authorization enforcement is implemented on the affected endpoint.",
  "technicalDetails": "The vulnerability resides in the vendor-orders endpoint implemented by the MStore API WordPress plugin, affecting all versions prior to 4.21.0. The root cause of the security defect is an Insecure Direct Object Reference (IDOR) or a missing function-level access control check. Specifically, the application endpoint fails to validate whether the authenticated user submitting the request possesses ownership rights over the requested order data or administrative privileges to oversee all store transactions.\nDuring standard operation, the vendor-orders endpoint is intended to supply order fulfillment details. However, the lack of contextual authorization validation allows any authenticated principal—regardless of whether they hold a Subscriber, Customer, or arbitrary low-level role—to query the endpoint successfully. When an attacker issues a standard HTTP request to the vulnerable endpoint, the backend controller processes the request without enforcing session-to-data isolation boundaries. Consequently, the database query retrieves and serializes all WooCommerce order records stored in the system.\nThe attack flow proceeds as follows: First, an attacker authenticates to the target WordPress site, obtaining a standard session cookie or application password corresponding to a low-privilege role such as Subscriber. Second, the attacker crafts an HTTP request targeting the vendor-orders endpoint exposed by the MStore API plugin. Third, the plugin processes the request without validating whether the requesting user ID matches the customer ID or vendor association tied to the requested orders. Fourth, the server responds with a comprehensive JSON payload containing exhaustive order details, including customer names, billing addresses, shipping details, email addresses, phone numbers, and purchased product metadata.\nThe network exposure is identical to the underlying WordPress REST API or plugin routing mechanism, typically accessible over standard HTTP/HTTPS protocols. The post-exploitation impact includes mass exfiltration of e-commerce transactional intelligence and customer PII, enabling malicious actors to conduct targeted phishing campaigns, identity theft, or competitive intelligence gathering against the affected merchant."
}