What is GHSA-2gpc-rx3g-g49h?

GHSA-2gpc-rx3g-g49h is a security advisory published by GitHub Security Advisories with Medium severity. The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a...

Which CVE IDs does GHSA-2gpc-rx3g-g49h cover?

GHSA-2gpc-rx3g-g49h covers the following CVE IDs: CVE-2026-97219. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2gpc-rx3g-g49h?

GHSA-2gpc-rx3g-g49h has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-2gpc-rx3g-g49hMediumCVSS 4.3

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-97219 →

📋 Description

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-97219
https://wpscan.com/vulnerability/0787d00b-2263-465f-8f46-906741bf6629
https://github.com/advisories/GHSA-2gpc-rx3g-g49h