CVE-2026-16038 in MStore API Plugin
Summary
by MITRE • 08/07/2026
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability resides in the MStore API WordPress plugin version 4.21.0 and earlier, where the payment verification process fails to properly validate transactions with the payment gateway before updating order status. This critical flaw exists across multiple payment-completion endpoints that handle order fulfillment, creating a significant security gap that allows unauthorized manipulation of payment statuses. The absence of proper authentication checks means that any unauthenticated attacker can exploit this weakness to mark orders as fully paid without actually processing legitimate payments.
This vulnerability fundamentally compromises the integrity of the e-commerce transaction flow by enabling man-in-the-middle or replay attack scenarios where malicious actors can manipulate order states through crafted API requests. The technical flaw represents a failure in input validation and authorization controls, specifically allowing arbitrary order status modifications without proper payment verification mechanisms. The vulnerability operates at the application layer and affects the core payment processing logic of the plugin, creating a direct path for financial loss through unauthorized order completion.
The operational impact of this vulnerability extends beyond simple financial gain as it enables systematic exploitation of the e-commerce platform's payment system. Attackers can repeatedly manipulate order statuses to obtain goods or services without payment, potentially leading to significant revenue loss and inventory depletion. The vulnerability affects all orders processed through the affected payment endpoints, making it particularly dangerous for businesses with high transaction volumes where the impact of unauthorized order modifications could be substantial.
From a cybersecurity perspective, this vulnerability aligns with CWE-862, which addresses insufficient authorization, and represents a clear failure in proper access control implementation. The flaw also maps to ATT&CK technique T1078.004, which covers valid accounts used for lateral movement, as attackers can leverage the compromised order status functionality to gain unauthorized access to payment systems. Organizations should immediately implement patch management procedures to upgrade to version 4.21.0 or later, while also reviewing their payment gateway integration logs for signs of exploitation. Additional mitigations include implementing proper authentication checks for all payment completion endpoints and establishing monitoring controls that flag unusual order status modifications.