MStore API Order Completion Authentication Bypass

Executive Summary

The MStore API WordPress plugin before version 4.21.1 has a flaw where it does not check if an order belongs to the user making the request. This allows any authenticated user, including low-privilege Subscribers, to mark any order as completed or paid without processing actual payment.

Useful 0 Not Useful 0

Detection Guidance

Check if the MStore API WordPress plugin version is below 4.21.1. Use WPScan or similar tools to scan for vulnerable plugin versions. Look for unauthorized order status changes in WooCommerce logs or database entries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to manipulate order statuses, leading to financial losses if orders are marked as paid without real transactions. It may also disrupt order management and cause confusion in billing systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to modify order statuses without payment, which may lead to improper data handling or financial discrepancies. Unauthorized access to order data could violate GDPR's data protection principles if personal data is exposed or altered without consent. For HIPAA, if the plugin handles protected health information in orders, unauthorized modifications could compromise data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MStore API plugin to version 4.21.1 or later immediately. Review order statuses for unauthorized changes and verify payments. Restrict user roles to prevent unauthorized access if updates are delayed.

Useful 0 Not Useful 0