MStore API EUVD-2026-43449

Exploitation requires only network access to a WordPress installation with the MStore API plugin installed and active in a version at or below 4.18.4. The CVSS vector (PR:N/AC:L/UI:N) confirms no authentication, no special configuration, and no user interaction are needed. The specific limiting factors are: impact is bounded to Low confidentiality and Low integrity - full administrative takeover or Availability impact is not indicated; exploitation is scoped to the plugin's API surface and does not directly imply wp-admin compromise. Sites that have disabled REST API access globally (via authentication enforcement on /wp-json/) would reduce exposure, but default WordPress installations leave REST endpoints publicly reachable.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:N/UI:N reflects a low-friction, network-accessible, unauthenticated attack path - the most favorable attacker posture short of a critical score. Confidentiality and Integrity impacts are both rated Low (C:L/I:L), and Availability is unaffected, which bounds realistic damage to partial data exposure or limited unauthorized writes rather than full site compromise. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code is known. The Patchstack report is the sole intelligence source; no independent vendor advisory or NVD enrichment was provided. Real-world priority should be calibrated by whether the site serves a mobile app with sensitive customer or order data: in that deployment context, unauthenticated access to WooCommerce API resources - even with limited scope - represents meaningful customer PII and order-data exposure risk. The absence of AC complexity and authentication requirements means automated mass scanning of WordPress installations for this endpoint is plausible.

An unauthenticated attacker enumerates a WordPress installation running MStore API (trivially detectable via /wp-json/ endpoint discovery) and issues HTTP requests directly to a protected REST API route - such as an order status, user profile, or product management endpoint - without supplying credentials. Because the authorization check is absent, the server processes the request and returns or modifies data as if the caller held the required role, exposing WooCommerce order data or allowing limited record manipulation. No exploit code is publicly known, but the low complexity and absence of any prerequisite make opportunistic scripted scanning straightforward.