The MStore API WordPress plugin fails to verify that an order belongs to the requester when marking it as completed. An authenticated user, even one with a Subscriber role, can arbitrarily declare any order paid and finalized without processing a payment. This flaw enables fraudulent chargebacks, financial loss, and undermines the integrity of the e‑commerce workflow.

Versions of the MStore API plugin older than 4.21.1 on WordPress sites are affected. No specific vendor field is provided beyond the plugin name, and no detailed version list is available beyond the known upper bound of 4.21.1.

The vulnerability requires authentication but not privileged access, so any logged‑in user can exploit it. The CVSS score is 6.5, indicating a medium‑high risk. The EPSS score is less than 1 percent, indicating a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Despite the lack of a public exploit, the attack surface is large because any Subscriber can use the affected endpoint to trigger payment fraud.