MStore API Order Completion Authentication Bypass

Executive Summary

The MStore API WordPress plugin before version 4.21.1 has a flaw where it does not check if an order belongs to the user making the request. This allows any authenticated user, including low-privilege Subscribers, to mark any order as completed or paid without processing actual payment.

Useful 0 Not Useful 0

Detection Guidance

Check if the MStore API WordPress plugin version is below 4.21.1. Use WPScan or similar tools to scan for vulnerable plugin versions. Look for unauthorized order status changes in WooCommerce logs or database entries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to manipulate order statuses, leading to financial losses if orders are marked as paid without real transactions. It may also disrupt order management and cause confusion in billing systems.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MStore API plugin to version 4.21.1 or later immediately. Review order statuses for unauthorized changes and verify payments. Restrict user roles to prevent unauthorized access if updates are delayed.

Useful 0 Not Useful 0