Description

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-29T06:17:20.960Z",
  "pubdate": "2026-08-29T06:17:20.960Z",
  "executiveSummary": "The MStore API WordPress plugin, in versions prior to 4.21.1, contains a critical Broken Access Control vulnerability regarding its wallet payment processing logic.\nThe vulnerability stems from a lack of server-side authorization checks, failing to verify that an authenticated user possesses the rights to modify or settle the payment status of a specific order.\nFurthermore, the implementation fails to trigger a corresponding deduction from the user's wallet balance for the majority of payment methods.\nThis flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to manipulate the order status in the backend to 'Paid'.\nThe impact includes financial fraud, unauthorized order fulfillment, and integrity compromise of the e-commerce transaction workflow.\nExploitation requires active authentication on the target system but does not require additional complex prerequisites, making it a high-risk security flaw for any WordPress site utilizing the MStore API for wallet-based transactions.",
  "technicalDetails": "The vulnerability resides within the MStore API's order and wallet payment processing functions. The root cause is twofold: insufficient authorization checks and improper business logic validation.\nWhen an order is processed via the wallet payment module, the API fails to implement an ownership validation check. Specifically, the backend logic does not cross-reference the `user_id` associated with the order ID being submitted with the `user_id` of the authenticated requester. Consequently, an attacker can supply any valid order ID (even one belonging to another user or a guest) within the API request parameters to target it for payment settlement.\nThe exploitation flow is as follows: An attacker authenticates to the WordPress instance using a standard account (e.g., Subscriber). The attacker identifies a target order ID through enumeration or application interaction. The attacker then constructs a malicious request to the wallet payment endpoint, specifying the target order ID. Because the plugin does not validate the relationship between the authenticated session and the order ownership, the API accepts the request.\nAdditionally, the system fails to verify that the wallet balance is sufficient or perform an atomic deduction of funds during the API call. The backend logic incorrectly assumes the validity of the payment without enforcing the ledger deduction required for the transaction. As a result, the order status is updated to 'Paid' in the database without any financial transaction occurring or funds being transferred from the user's wallet.\nThis bypasses the payment gateway or wallet deduction entirely, allowing an attacker to mark any order as fulfilled. The vulnerability is present in all versions prior to 4.21.1. Post-exploitation, the impact is severe, as it facilitates the circumvention of payment requirements, leading to potential inventory loss and revenue depletion for the merchant. The attack is performed via standard HTTP request manipulation to the MStore API endpoints, requiring no elevated privileges beyond basic site authentication."
}