Veille CVE

Recherche « MStore API »

12 CVE

Critique 3 Élevée 3 Moyenne 6 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « MStore API » ✕
  1. CVE-2026-97219 4.3 Moyenne

    Unknown MStore API

    The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

  2. CVE-2026-13447 9.8 Critique

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud

    The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

  3. CVE-2026-18234 6.5 Moyenne

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

  4. CVE-2026-18233 6.5 Moyenne

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

  5. CVE-2026-27543 8.1 Élevée

    FluxBuilder MStore API

    Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

  6. CVE-2026-16041 7.5 Élevée

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

  7. CVE-2026-16039 6.5 Moyenne

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

  8. CVE-2026-16038 9.1 Critique

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

  9. CVE-2026-16030 8.1 Élevée

    Unknown MStore API

    The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

  10. CVE-2026-57375 6.5 Moyenne

    FluxBuilder MStore API

    Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.

  11. CVE-2026-54817 6.5 Moyenne

    FluxBuilder MStore API

    Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.

  12. CVE-2021-47933 9.8 Critique

    MStore API

    WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.