What is the CVSS score of CVE-2026-27543?

CVE-2026-27543 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of MStore API are affected by CVE-2026-27543?

The MStore API WordPress plugin (v4.20.0 and earlier) contains an unauthenticated remote privilege escalation vulnerability (CVSS 8.1) that could allow attackers to gain administrative control of…

How to fix or mitigate CVE-2026-27543?

Within 24 hours, audit all WordPress installations to identify and deactivate the MStore API plugin version 4.20.0 or earlier; plugin removal is the most effective interim control. Within 7 days, implement WAF rules blocking requests to /wp-json/mstore/ API endpoints and establish monitoring and alerting for exploitation attempts in access logs. Within 30 days, contact the plugin vendor to confirm patch availability timeline, evaluate functionally equivalent maintained alternatives, and complete migration away from this plugin if no security update is released.

MStore API CVE-2026-27543

EUVD-2026-57938 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-13 Patchstack

GHSA-cvhf-m4qh-hf7x

WordPress Privilege Escalation Mstore Api Wordpress Plugin Fluxbuilder

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable REST API endpoint, unauthenticated, but AC:H reflects specific condition required; full CIA impact consistent with privilege escalation to admin.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:02 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

AnalysisAI

Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.

Technical ContextAI

MStore API is a WordPress plugin developed by FluxBuilder (CPE: cpe:2.3:a:fluxbuilder:mstore_api:*:*:*:*:*:*:*:*) that provides REST API backend functionality enabling WordPress and WooCommerce sites to power native mobile applications. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants or promotes user privileges during some API operation - likely during user registration, authentication, or token handling flows exposed through WordPress REST API endpoints. The AC:H rating suggests exploitation depends on a specific application state, timing condition, or configuration, rather than being a trivially reproducible one-shot attack. All three CIA dimensions are rated High, consistent with achieving administrator-level access within the WordPress context.

RemediationAI

The primary remediation is to update the MStore API plugin to a version beyond 4.20.0; patch availability is confirmed per the Patchstack advisory, but the exact patched release version is not independently confirmed in the provided data - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mstore-api/vulnerability/wordpress-mstore-api-plugin-4-20-0-privilege-escalation-vulnerability?_s_id=cve) or the WordPress plugin repository for the current fixed release. If an immediate update is not possible, consider disabling the MStore API plugin entirely until patching is feasible, accepting the trade-off of losing mobile app API functionality. Restricting access to the WordPress REST API at the network perimeter (e.g., via WAF rules or IP allowlisting for REST API endpoints) can reduce attack surface but may break legitimate mobile app consumers. Enabling WordPress login and REST API audit logging will help detect exploitation attempts in the interim.