MEDIUM 4.3 NVD

CVE-2026-97219

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-regi

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

References

https://wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629/

Published: 2026-10-02 · Source: NVD · Feed updated: 2026-10-02

This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-02 via NVD.

vulnfeed aggregates 10476 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.