Skip to main content

MStore API CVE-2026-57375

| EUVDEUVD-2026-43449 MEDIUM
Missing Authorization (CWE-862)
2026-07-13 Patchstack
Authentication Bypass Mstore Api
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-accessible REST API with no authentication required (PR:N, AV:N, AC:L); limited read/write impact consistent with broken access control, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
Analysis Generated
Jul 13, 2026 - 11:28 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.

AnalysisAI

Broken access control in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to bypass authorization checks on restricted API endpoints. Rooted in CWE-862 (Missing Authorization), the flaw enables callers to interact with functionality gated behind access control levels that are incorrectly enforced - resulting in limited unauthorized data read and write operations against affected WooCommerce-backed mobile API deployments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Discover WordPress site with MStore API active
Exploit
Send unauthenticated HTTP request to protected REST endpoint
Execution
Server skips authorization check
Impact
Access or modify restricted WooCommerce data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network access to a WordPress installation with the MStore API plugin installed and active in a version at or below 4.18.4. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:N/UI:N reflects a low-friction, network-accessible, unauthenticated attack path - the most favorable attacker posture short of a critical score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker enumerates a WordPress installation running MStore API (trivially detectable via /wp-json/ endpoint discovery) and issues HTTP requests directly to a protected REST API route - such as an order status, user profile, or product management endpoint - without supplying credentials. Because the authorization check is absent, the server processes the request and returns or modifies data as if the caller held the required role, exposing WooCommerce order data or allowing limited record manipulation. …
Remediation Update the MStore API WordPress plugin to a version released after 4.18.4; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mstore-api/vulnerability/wordpress-mstore-api-plugin-4-18-4-broken-access-control-vulnerability should be consulted for the exact fixed version once published. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mstore Api

View all
CVE-2023-2732 CRITICAL POC
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
CVE-2023-2734 CRITICAL POC
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
CVE-2023-3277 CRITICAL POC
9.8 Nov 03

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
CVE-2023-3197 CRITICAL POC
9.8 Jun 24

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
CVE-2020-36713 CRITICAL POC
9.8 Jun 07

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
CVE-2023-3077 CRITICAL POC
9.8 Jul 10

The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
CVE-2023-3076 CRITICAL POC
9.8 Jul 10

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
CVE-2024-6328 CRITICAL
9.8 Jul 12

The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa
CVE-2023-2733 CRITICAL
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. Rate
CVE-2021-24148 CRITICAL
9.8 Mar 18

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign
CVE-2024-8242 HIGH
8.8 Sep 13

The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uplo
CVE-2023-3131 MEDIUM POC
4.3 Jul 10

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks,

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-57375 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy