CVE-2026-18234 Overview
CVE-2026-18234 affects the MStore API WordPress plugin in versions before 4.21.1. The plugin's wallet payment handler fails to verify that the order being paid belongs to the authenticated requester. It also does not deduct the wallet balance for most payment methods. Any authenticated user, including low-privilege Subscribers, can mark arbitrary orders as paid without any funds being taken. The flaw is categorized under [CWE-862] Missing Authorization and stems from a broken access control check in the payment workflow.
Critical Impact
Authenticated users with Subscriber-level access can mark arbitrary WooCommerce orders as paid without transferring funds, resulting in financial loss to store operators.
Affected Products
- MStore API WordPress plugin versions prior to 4.21.1
- WordPress sites running WooCommerce integrated with MStore API
- Mobile commerce backends built on the MStore API endpoints
Discovery Timeline
- 2026-08-29 - CVE-2026-18234 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-18234
Vulnerability Analysis
The MStore API plugin exposes a wallet payment handler used to settle WooCommerce orders through the mobile storefront. The handler accepts an order identifier from the authenticated caller and marks the referenced order as paid. Two controls are missing from this flow. First, the endpoint does not check that the current user owns the order identified in the request. Second, the handler does not deduct the wallet balance for most supported payment methods. These omissions allow any logged-in account to complete other customers' orders at no cost.
Root Cause
The root cause is missing authorization on a state-changing API action [CWE-862]. The handler trusts the order ID parameter without correlating it to the requesting user's account. Subscriber-level accounts, which WordPress permits self-registration for on many storefronts, retain enough privilege to reach the endpoint.
Attack Vector
An attacker registers or logs into a Subscriber account on the target WordPress site. The attacker enumerates or guesses WooCommerce order IDs and submits them to the vulnerable wallet payment endpoint. The plugin marks each targeted order as paid and does not withdraw any balance from the attacker's wallet. Store operators then fulfill orders that were never funded.
The vulnerability manifests in the wallet payment handler's order-processing logic. See the WPScan Vulnerability Report for further technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-18234
Indicators of Compromise
- WooCommerce orders transitioning to a paid status without a corresponding gateway transaction record
- Wallet payment API requests originating from Subscriber accounts that do not own the referenced order
- Discrepancies between paid order totals and wallet ledger debits in MStore API logs
Detection Strategies
- Review WooCommerce order history for orders marked paid via the wallet method without matching wallet balance deductions
- Correlate user_id on the API request with the customer_id on each order that transitioned to paid status
- Alert on repeated wallet payment API calls from a single Subscriber account against multiple distinct order IDs
Monitoring Recommendations
- Enable verbose logging on MStore API endpoints, particularly wallet payment routes
- Monitor WordPress authentication logs for bursts of new Subscriber registrations followed by API activity
- Track order status changes in the WooCommerce audit trail and reconcile against payment gateway settlement reports
How to Mitigate CVE-2026-18234
Immediate Actions Required
- Update the MStore API plugin to version 4.21.1 or later on all WordPress installations
- Audit recent WooCommerce orders for unauthorized paid transitions and reverse fulfillment where appropriate
- Restrict new user registration or require email verification if Subscriber self-registration is not required
Patch Information
The vendor addressed the issue in MStore API version 4.21.1. The patched release adds ownership verification against the requesting user and corrects wallet balance deduction across supported payment methods. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the wallet payment method in WooCommerce settings until the plugin is updated
- Block access to the MStore API wallet payment endpoints at the web application firewall for unauthenticated and Subscriber-level traffic
- Temporarily disable new customer self-registration to reduce the pool of accounts able to reach the endpoint
# Example WordPress CLI update command
wp plugin update mstore-api --version=4.21.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
