What is the CVSS score of CVE-2026-57375?

CVE-2026-57375 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

MStore API CVE-2026-57375

Q: Which versions of MStore API are affected by CVE-2026-57375?

Broken access control in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to bypass authorization checks on restricted API endpoints.

EUVD-2026-43449 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Mstore Api Wordpress Plugin Fluxbuilder

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible REST API with no authentication required (PR:N, AV:N, AC:L); limited read/write impact consistent with broken access control, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:28 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.

AnalysisAI

Broken access control in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to bypass authorization checks on restricted API endpoints. Rooted in CWE-862 (Missing Authorization), the flaw enables callers to interact with functionality gated behind access control levels that are incorrectly enforced - resulting in limited unauthorized data read and write operations against affected WooCommerce-backed mobile API deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS vector confirms the attack requires no authentication or special conditions.

Technical ContextAI

MStore API (CPE: cpe:2.3:a:fluxbuilder:mstore_api:*:*:*:*:*:*:*:*) is a WordPress plugin published by FluxBuilder that exposes REST API endpoints enabling WooCommerce stores to power native mobile applications. The root cause is CWE-862 (Missing Authorization): one or more API endpoints fail to verify whether the requesting user holds the required capability or role before executing privileged operations. This class of flaw - sometimes called Broken Access Control (OWASP A01:2021) - differs from authentication bypass in that the user identity may be established (or absent entirely), but the authorization gate protecting the endpoint is simply absent or misconfigured. The tag 'Authentication Bypass' assigned by Patchstack indicates the missing check can be exploited without any credential at all, consistent with the CVSS PR:N metric.

RemediationAI

Update the MStore API WordPress plugin to a version released after 4.18.4; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mstore-api/vulnerability/wordpress-mstore-api-plugin-4-18-4-broken-access-control-vulnerability should be consulted for the exact fixed version once published. If an immediate upgrade is not possible, consider temporarily disabling the MStore API plugin until a patched release is confirmed - this eliminates the attack surface entirely but will break any dependent mobile application. As a secondary mitigation, configure a Web Application Firewall (WAF) rule to restrict access to the plugin's REST API endpoints (typically prefixed under /wp-json/mstore/) to only known mobile app IP ranges; note this is impractical for public consumer apps with dynamic IP clients. WordPress administrators should also audit user roles and plugin REST API registrations to verify no unintended capability assignments are present. Verify the exact fixed version number from Patchstack or the WordPress plugin repository before applying, as that data was not confirmed in the provided intelligence.