CVE-2026-97219

Publié : 2 octobre 2026

Modifié : 2 octobre 2026

Score CVSS

4.3

MEDIUM

Description détaillée

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629/

Dernières Vulnérabilités

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

VOIR DÉTAILS

CVE-2026-93697

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

VOIR DÉTAILS

CVE-2026-93029

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

VOIR DÉTAILS