MStore API CVE-2026-54817

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and no user interaction is needed, making exploitation possible against any internet-accessible WordPress site with MStore API 4.18.4 or earlier installed and active. The specific exploitation path runs through the password recovery functionality exposed by the plugin's REST API endpoints - meaning the plugin must be installed, activated, and its API endpoints must be reachable (standard WordPress REST API access, enabled by default). Exploitation is limited to WordPress deployments using WooCommerce-based mobile apps via MStore API; sites without the plugin are unaffected. There is no indication that a non-default configuration is required - the vulnerable recovery path appears to be part of standard plugin operation.

The CVSS 3.1 base score of 6.5 (Medium) is backed by a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating network-reachable, low-complexity, zero-authentication exploitation. The absence of a confidentiality impact (C:N) in the NVD-assigned vector is noteworthy and may underrepresent realistic risk - a successful password-recovery bypass could grant unauthorized access to victim accounts, implying at minimum a C:L impact; this discrepancy should be verified against vendor clarification. No EPSS score was supplied, limiting probabilistic exploitation assessment. Neither CISA KEV inclusion nor public proof-of-concept code has been identified, reducing the urgency of emergency patching. However, WordPress plugins with no-auth, low-complexity network vectors are historically attractive for mass scanning and automated exploitation. The practical risk is moderate: organizations running WooCommerce mobile storefronts with MStore API exposed are the relevant target population, and the ease of exploitation (AC:L, PR:N) offsets the lack of current known active exploitation.

An unauthenticated attacker enumerates a valid WordPress username or email address on a site running MStore API through 4.18.4, then sends a crafted request directly to the plugin's password recovery API endpoint, bypassing the expected authentication or token-validation step. By exploiting the alternate channel exposed by the recovery flow, the attacker can trigger an unauthorized account state change - such as resetting another user's password or obtaining a recovery token - without possessing valid credentials. No public proof-of-concept code has been identified, but the low attack complexity suggests this attack is reproducible with basic REST API interaction.