Quick answers
- Is CVE-2026-18234 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18234 being exploited in the wild.
- How severe is CVE-2026-18234?
- Medium severity, with a CVSS score of 6.5, published 29 August 2026.
- Which products and versions are affected?
- MStore API before 4.21.1.
- Is there a fix for CVE-2026-18234?
- A patch was published on 2026-08-29: Fixed in version 4.21.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18234 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-18234?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the wallet payment handling endpoint (/wp-json/api/flutter_tera_wallet/process_payment). The plugin fails to verify that the order being marked as paid belongs to the authenticated requester, and only deducts wallet balance when the target order's own payment method is wallet-based—not for other payment methods. An authenticated attacker can enumerate WooCommerce order IDs (which are sequential integers) and send a POST request with a victim's order ID to mark arbitrary unpaid orders as completed. The vulnerability requires authentication (Subscriber role or above) and a wallet balance equal to at least one target order total, but once established, allows unlimited fraud with no per-order payment deduction. Fixed in version 4.21.1.
Affected products
- MStore API before 4.21.1
Timeline
- 2026-08-27: disclosed
- 2026-08-29: patched: Fixed in version 4.21.1