CyberRota Analysis
AI-GeneratedThe MStore API WordPress plugin prior to version 4.21.1 is vulnerable as it fails to verify the ownership of orders during wallet payment processing, allowing any authenticated user, including those with Subscriber roles, to falsely mark orders as paid without actual payment. This could lead to significant financial losses and unauthorized access to services. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.