What’s Vulnerable › Vulnerabilities
CVE-2026-18234: MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-29 · updated 2026-08-31
- Weakness: CWE-862
Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
Affected products
- inspireui MStore API – Create Native Android & iOS Apps On The Cloud: before 4.21.1 — fixed in 4.21.1
How to fix
Upgrade to a fixed version: inspireui MStore API – Create Native Android & iOS Apps On The Cloud 4.21.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18234 or the next vulnerability affects your stack