MStore API EUVD-2026-57938

Exploitation requires an internet-accessible WordPress installation with the MStore API plugin (version 4.20.0 or earlier) installed and active. The CVSS vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required; however, AC:H indicates a specific condition must be met - likely a race condition in an API handler, a specific sequence of API calls, or a particular plugin state. No default-configuration restriction or special platform requirement beyond the plugin being active has been confirmed from available data. Limiting factors include the AC:H requirement (not trivially automated or scripted from a single request), and the need for the mobile API feature to be enabled and publicly reachable. Sites that have the plugin installed but with REST API access restricted at the firewall level would face materially reduced risk.

The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals a serious but conditionally exploitable vulnerability. The network-reachable, unauthenticated nature of the flaw is significant - no foothold or prior credentials are needed. However, AC:H meaningfully reduces the ease of exploitation; attackers must satisfy some specific precondition such as a race condition, a particular API state, or a non-default plugin configuration. No EPSS score was provided, no active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified in the supplied data. In practice, this places the vulnerability in a 'monitor and patch promptly' category for organizations running the MStore API plugin: lower urgency than a KEV-listed or trivially scriptable flaw, but the full CIA impact means successful exploitation results in complete site compromise. The absence of both KEV and POC data should not be interpreted as low risk - privilege escalation vulnerabilities in widely-used plugins are a frequent target of opportunistic WordPress threat actors.

An unauthenticated remote attacker identifies a WordPress site running MStore API 4.20.0 or earlier via plugin fingerprinting. The attacker crafts a sequence of API requests targeting the plugin's user-handling or registration endpoints, exploiting the incorrect privilege assignment logic under the required attack condition (such as a race condition or specific API state). Upon success, the attacker obtains a WordPress session or token with elevated - potentially administrator-level - privileges, enabling full site takeover including content modification, credential harvesting, and backdoor installation. No public exploit code has been identified at time of analysis, but the attack pattern is consistent with known WordPress plugin privilege escalation techniques.