CyberRota Analysis
AI-GeneratedThe MStore API WordPress plugin prior to version 4.21.1 is vulnerable due to insufficient verification of order ownership, enabling any authenticated user, including those with Subscriber roles, to mark any order as completed and paid without processing a payment. This flaw could lead to unauthorized financial transactions and manipulation of order statuses, posing a significant risk to e-commerce operations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.