What is the CVSS score of EUVD-2026-20840?

EUVD-2026-20840 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP EUVD-2026-20840

| CVE-2026-3568 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-09 Wordfence

GHSA-fg73-jmcf-5xr8

WordPress PHP XSS Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20840

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp_user_level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., _wpuf_user_active, aiowps_account_status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp_capabilities cannot be directly exploited this way because it requires a serialized array value, but wp_user_level (a simple integer) and numerous plugin-specific meta keys are exploitable.

AnalysisAI

Authenticated subscribers and above in WordPress sites using MStore API plugin up to version 4.18.3 can modify arbitrary user meta fields on their own accounts, including legacy privilege escalation keys like wp_user_level and plugin-specific authorization flags, potentially leading to privilege escalation or stored XSS. The vulnerability stems from the update_user_profile() function accepting unsanitized, user-supplied meta_data JSON without allowlist or validation before passing it directly to update_user_meta(). No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

The MStore API plugin (CPE: cpe:2.3:a:inspireui:mstore_api_-_create_native_android_&_ios_apps_on_the_cloud:*:*:*:*:*:*:*:*) exposes a REST API endpoint that processes user profile updates via the update_user_profile() function in controllers/flutter-user.php. The function reads raw JSON from php://input, decodes it without schema validation, and performs basic cookie-based authentication. However, it then directly iterates over the user-supplied meta_data array and passes arbitrary key-value pairs to WordPress's update_user_meta() function with no validation of which meta keys are allowed. This is a classic Insecure Direct Object Reference (IDOR) vulnerability combined with improper input validation (CWE-639). While WordPress's wp_capabilities field is protected by serialization requirements, legacy meta keys such as wp_user_level (a simple integer used by older privilege checks) and plugin-specific flags (_wpuf_user_active, aiowps_account_status) are directly exploitable. Additionally, unsanitized billing and profile meta fields stored via this function could be rendered in admin contexts, enabling stored XSS.

RemediationAI

Update MStore API to version 4.18.4 or later immediately, as patched versions are available per the WordPress plugin repository. The fix involves implementing a meta key allowlist in the update_user_profile() function to restrict which user meta fields can be modified via the API, and sanitizing all user-supplied values before passing them to update_user_meta(). Administrators should audit their user meta fields (via wp-cli: wp user list --meta --field=user_login,meta_data or via phpmyadmin) to identify any suspicious modifications made by subscribers during the vulnerability window. For sites unable to patch immediately, disable the MStore API plugin or restrict API access via Web Application Firewall rules until patching is completed. Refer to the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a77bc126-4dbd-4a26-b98c-946341d4282f) for detailed patch information and the WordPress plugin repository changelog.