Mstore Api (Unknown) - vulnerabilities (CVEs)
12 CVEs, 1 in the last 30 days, 1 known versions, newest CVE from 2026-10-02. Vendor: Unknown.
CVEs of Mstore Api
- CVE-2026-97219 - CVSS 4.3 (medium), 2026-10-02: The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a…
- CVE-2026-18234 - CVSS 6.5 (medium), 2026-08-29: The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not…
- CVE-2026-18233 - CVSS 6.5 (medium), 2026-08-29: The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any…
- CVE-2026-16038 - CVSS 9.1 (critical), 2026-08-07: The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its…
- CVE-2026-16030 - CVSS 8.1 (high), 2026-08-07: The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login,…
- CVE-2026-16041 - CVSS 7.5 (high), 2026-08-07: The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing…
- CVE-2026-16039 - CVSS 6.5 (medium), 2026-08-07: The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user,…
- CVE-2023-3131 - CVSS 4.3 (medium), 2023-07-10: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- CVE-2023-3209 - CVSS 3.5 (low), 2023-07-10: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- CVE-2023-3077 - CVSS 9.8 (critical), 2023-07-10: The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection…
- CVE-2023-3076 - CVSS 9.8 (critical), 2023-07-10: The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API…
- CVE-2021-24148 - CVSS 9.8 (critical), 2021-03-18: A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing…
