An unauthenticated critical vulnerability in the MStore API WordPress plugin allows attackers to bypass payment verification and fraudulently mark orders as paid.

The vulnerability is a missing authorization flaw (CWE-862) within the payment-completion endpoints. An unauthenticated attacker can trigger these endpoints to finalize arbitrary orders without completing a legitimate transaction.

This vulnerability poses a severe risk of direct financial loss and inventory depletion for merchants. With a CVSS score of 9.1, it is classified as critical, as it allows unauthorized access to transaction flows, potentially leading to widespread fraudulent activity and reputational damage.

Immediate Action: Update the MStore API WordPress plugin to version 4.21.0 or later immediately to apply the necessary payment verification logic.

Proactive Monitoring: Monitor transaction logs for an unusual volume of successfully marked orders that lack corresponding payment gateway confirmation records.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to identify and block unauthorized access attempts to payment-completion API endpoints.

Public Exploit Available: Yes, as indicated by security research documentation.

Given the critical nature of this vulnerability and the potential for direct financial theft, immediate patching is required. Administrators should verify that all installations of the MStore API plugin are updated to 4.21.0, and perform a forensic audit of recent order records to identify any potentially fraudulent transactions that may have occurred prior to the update.