Medium severity4.3NVD Advisory· Published Oct 2, 2026

CVE-2026-97219

Description

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

Affected products

WordPress/Mstore APIllm-fuzzy
Range: <4.22.1
Package: https://wordpress.org/plugins/mstore-api

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629/nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000