Executive brief
MStore API is a WordPress plugin that integrates WooCommerce e-commerce orders with delivery systems. The plugin fails to verify that orders being modified belong to the person making the request, allowing any logged-in user—even low-privilege subscribers—to mark other customers' orders as completed and paid without actual payment. This enables fraudulent order completion, release of digital goods without compensation, and significant financial loss.
Technical details
The vulnerability is an authorization bypass (CWE-862) in a delivery endpoint that modifies order status. The affected REST API endpoint (PUT /wp-json/delivery/orders) accepts an order_id parameter but does not verify ownership before applying state changes (marking paid, setting completion status). Authentication requires only a logged-in WordPress cookie (Subscriber role or above), with no additional access control checks. An attacker can enumerate WooCommerce order IDs (sequential integers) and complete any order, triggering fulfillment logic and releasing digital downloads. The vulnerability is fixed in version 4.21.1.
Affected products
- Automattic MStore API before 4.21.1
Timeline
- 2026-08-27: disclosed
- 2026-08-29: patched: Fixed in version 4.21.1