CVE-2026-18233 Overview
CVE-2026-18233 is a missing authorization vulnerability in the MStore API WordPress plugin before version 4.21.1. The plugin fails to verify that an order targeted by one of its delivery endpoints belongs to the requester. Any authenticated user, including low-privilege Subscribers, can mark arbitrary orders as completed and paid without processing any payment. The flaw is tracked under CWE-862: Missing Authorization and affects WooCommerce-backed storefronts that expose the MStore API for mobile app integrations.
Critical Impact
Any authenticated user, including Subscribers, can mark arbitrary WooCommerce orders as completed and paid, leading to fraudulent order fulfillment and direct financial loss for merchants.
Affected Products
- MStore API WordPress plugin versions prior to 4.21.1
- WordPress sites running WooCommerce integrated with the MStore API mobile backend
- E-commerce deployments exposing MStore API delivery endpoints to authenticated users
Discovery Timeline
- 2026-08-29 - CVE-2026-18233 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-18233
Vulnerability Analysis
The MStore API plugin exposes REST endpoints that let mobile applications interact with WooCommerce orders. One of these delivery endpoints updates the status of an order to completed and marks it as paid. The endpoint accepts an order identifier from the request but does not confirm that the authenticated caller owns the referenced order.
Because WordPress issues Subscriber accounts to any registered user on sites that allow open registration, an attacker only needs a valid low-privilege session to invoke the endpoint. The plugin trusts the supplied order ID and transitions the order to a paid, fulfilled state. Merchants then ship goods or grant digital access even though no payment was captured by the payment gateway.
Root Cause
The root cause is a missing authorization check on the delivery endpoint. The handler validates authentication but omits a capability or ownership check that ties the requesting user to the target order. This aligns with CWE-862: Missing Authorization, where the application performs an action without verifying that the actor is permitted to perform it against the specific resource.
Attack Vector
Exploitation requires network access to the WordPress REST API and a valid authenticated session at Subscriber level or higher. The attacker registers or reuses an account, obtains an authentication token accepted by the MStore API, and issues a request to the delivery endpoint with the target order identifier. The vulnerable handler completes and marks the specified order as paid. No user interaction from the victim merchant or original order owner is required.
The vulnerability mechanism is described in the WPScan Vulnerability Report. No verified proof-of-concept code is published in the referenced advisory.
Detection Methods for CVE-2026-18233
Indicators of Compromise
- WooCommerce orders transitioning to completed status without a matching payment gateway transaction record.
- REST API access logs showing Subscriber-level accounts calling MStore API delivery or order-status endpoints.
- Orders marked paid where the customer_id in the order metadata does not match the authenticated user that triggered the status change.
- Sudden clusters of order completions originating from a small set of IP addresses or user accounts.
Detection Strategies
- Review WordPress and WooCommerce audit logs for order status transitions performed by users other than administrators, shop managers, or the order owner.
- Reconcile WooCommerce order state against payment gateway settlement reports and flag mismatches for investigation.
- Alert on REST API calls to MStore API endpoints made by accounts with the subscriber role.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and forward events to a centralized SIEM for correlation.
- Track new user registrations followed within a short window by REST API calls to MStore API order endpoints.
- Monitor WooCommerce webhook events for order.updated transitions to completed that lack a corresponding payment_complete event.
How to Mitigate CVE-2026-18233
Immediate Actions Required
- Upgrade the MStore API plugin to version 4.21.1 or later on all WordPress sites.
- Audit WooCommerce orders completed since the plugin was installed and reverse fraudulent fulfillments.
- Temporarily disable open user registration or restrict Subscriber account creation until patching is confirmed.
- Rotate API keys and authentication tokens used by the MStore API mobile clients after upgrading.
Patch Information
The vendor addressed the missing authorization check in MStore API version 4.21.1. Site operators should update through the WordPress plugin repository or by deploying the vendor-supplied package. Refer to the WPScan Vulnerability Report for advisory details and fixed-version confirmation.
Workarounds
- Disable the MStore API plugin until the site can be upgraded to version 4.21.1.
- Restrict access to the WordPress REST API using a web application firewall rule that blocks MStore API delivery endpoints for non-administrative roles.
- Require a customer role higher than Subscriber for order-related endpoints via custom capability checks.
# Example WP-CLI commands to inventory and update the affected plugin
wp plugin list --name=mstore-api --fields=name,status,version
wp plugin update mstore-api --version=4.21.1
wp plugin verify-checksums mstore-api
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
