MStore API EUVD-2026-54387

Exploitation requires a valid authenticated WordPress session at Subscriber level or higher - the lowest role available after user registration. The attacker does not need any special capabilities beyond having an active account on the target site. The primary limiting factor is account access: sites with WordPress user registration disabled significantly reduce the exploitable population, as the attacker must obtain credentials through other means (credential stuffing, phishing, purchase on underground markets) rather than self-registration. Additionally, the target site must have the MStore API plugin installed, activated, and integrated with an active WooCommerce instance. No special plugin configuration or non-default settings are required beyond the plugin being present - the vulnerable endpoint is exposed by default upon plugin activation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) accurately characterizes the attack profile: network-accessible, low complexity, requiring only low-privileged authentication - any valid WordPress account including Subscribers. The High confidentiality rating reflects unrestricted access to all customer PII and purchase records, which carries regulatory implications (GDPR, CCPA) beyond the technical severity score. Integrity and availability are unaffected. EPSS at 0.13% (3rd percentile) is unexpectedly low given that a public POC exists and the attack complexity is minimal; this likely reflects the niche deployment footprint of MStore API rather than low exploitability of the flaw itself. There is no CISA KEV listing, so active exploitation is not confirmed by that channel. Real-world priority is high for stores with public user registration enabled, where an attacker can self-provision the Subscriber account needed - but substantially lower for stores where registration is closed and account access must be obtained by other means.

A publicly available exploit exists per WPScan (https://wpscan.com/vulnerability/85c6ff37-4761-420c-970f-05b2c50d3b28/). An attacker registers a free Subscriber account on the target WooCommerce store, authenticates to the WordPress REST API, and issues a GET request to the /vendor-orders endpoint without additional parameters. The server responds with all store orders - including customer names, billing addresses, email addresses, and line-item purchase details - enabling bulk exfiltration of customer PII in a single or paginated series of requests.