What’s Vulnerable › Vulnerabilities
CVE-2026-18233: MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-29 · updated 2026-08-31
- Weakness: CWE-862
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
Affected products
- inspireui MStore API – Create Native Android & iOS Apps On The Cloud: before 4.21.1 — fixed in 4.21.1
How to fix
Upgrade to a fixed version: inspireui MStore API – Create Native Android & iOS Apps On The Cloud 4.21.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18233 or the next vulnerability affects your stack