Unauthenticated Order Status Change in MStore API WordPress Plugin

Executive Summary

This vulnerability in the MStore API WordPress plugin before version 4.22.1 allows authenticated users with self-registerable accounts to change the status of their own unpaid orders to paid or fulfilled without making a payment. This effectively lets them receive goods without paying.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the MStore API plugin in your WordPress environment. If the version is between 4.21.1 and 4.22.0, the system is vulnerable. Review order logs for unauthorized status changes from unpaid to paid or fulfilled by users without payment.

Useful 0 Not Useful 0

Impact Analysis

If you use the MStore API plugin in WordPress and have self-registerable accounts, attackers could exploit this to receive products without payment. This could lead to financial losses for your business and undermine trust in your order processing system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to goods without payment, potentially violating financial transaction integrity requirements in standards like PCI DSS. It may also impact data integrity and accountability principles in GDPR and HIPAA if order status changes are logged or processed without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MStore API plugin to version 4.22.1 or later immediately. Disable self-registerable accounts if not required. Monitor order status changes for suspicious activity and restrict user permissions to prevent unauthorized modifications.

Useful 0 Not Useful 0