CVE-2026-97219

Name of the Vulnerable Software and Affected Versions MStore API WordPress plugin versions prior to 4.22.1

Description The plugin fails to restrict which order fields a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or fulfilled state, enabling them to obtain goods without payment.

Recommendations Update MStore API WordPress plugin to version 4.22.1 or later.