What is GHSA-jmq8-gg6r-m32f?

GHSA-jmq8-gg6r-m32f is a security advisory published by GitHub Security Advisories with Medium severity. The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its...

Which CVE IDs does GHSA-jmq8-gg6r-m32f cover?

GHSA-jmq8-gg6r-m32f covers the following CVE IDs: CVE-2026-18234. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jmq8-gg6r-m32f?

GHSA-jmq8-gg6r-m32f has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-jmq8-gg6r-m32fMediumCVSS 6.5

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its...

Vendor

GitHub Security Advisories

Published

August 29, 2026

Last Modified

August 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-18234 →

📋 Description

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18234
https://wpscan.com/vulnerability/1dc31c4e-9687-4056-a93e-9509c5a88828
https://github.com/advisories/GHSA-jmq8-gg6r-m32f