What is the CVSS score of CVE-2026-54817?

CVE-2026-54817 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

MStore API CVE-2026-54817

MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-17 Patchstack

WordPress Authentication Bypass Mstore Api Wordpress Plugin Fluxbuilder

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Auth bypass via password recovery grants unauthorized account access, warranting C:L; no clear availability impact from this attack class justifies A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:52 vuln.today

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.

This issue affects MStore API: from n/a through 4.18.4.

AnalysisAI

Authentication bypass in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to exploit the password recovery flow as an alternate authentication channel, circumventing normal credential verification. Confirmed by Patchstack under CWE-288, the flaw enables unauthorized manipulation of user account state with low integrity and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable conditions from the network without any authentication.

Technical ContextAI

MStore API (CPE: cpe:2.3:a:fluxbuilder:mstore_api:*:*:*:*:*:*:*:*) is a WordPress plugin by FluxBuilder that exposes REST API endpoints enabling WooCommerce-powered mobile applications to authenticate users, manage carts, and handle orders. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes a root cause where the application implements a secondary code path - in this case the password recovery mechanism - that does not enforce the same authentication controls as the primary login flow. Rather than a broken cryptographic implementation, this class of flaw typically arises when a recovery or reset endpoint is accessible without session validation, enabling an attacker to trigger account changes for arbitrary users by interacting directly with the recovery API endpoint rather than the guarded authentication endpoint.

RemediationAI

Update MStore API to a version beyond 4.18.4 via the WordPress plugin dashboard or by downloading the patched release from the WordPress.org plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mstore-api/vulnerability/wordpress-mstore-api-plugin-4-18-4-broken-authentication-vulnerability should be consulted for the confirmed fixed version number, which was not explicitly stated in the available intelligence. If an immediate update is not possible, consider restricting access to the MStore API REST endpoints at the web server or WAF layer (e.g., blocking or rate-limiting requests to /wp-json/mstore-api/ routes associated with password recovery) as a temporary compensating control, with the trade-off that this may break legitimate mobile app password reset functionality for end users. Disabling the plugin entirely until patched is the most conservative interim measure.