Fluxbuilder
Monthly
Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.
Broken access control in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to bypass authorization checks on restricted API endpoints. Rooted in CWE-862 (Missing Authorization), the flaw enables callers to interact with functionality gated behind access control levels that are incorrectly enforced - resulting in limited unauthorized data read and write operations against affected WooCommerce-backed mobile API deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS vector confirms the attack requires no authentication or special conditions.
Authentication bypass in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to exploit the password recovery flow as an alternate authentication channel, circumventing normal credential verification. Confirmed by Patchstack under CWE-288, the flaw enables unauthorized manipulation of user account state with low integrity and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable conditions from the network without any authentication.
Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.
Broken access control in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to bypass authorization checks on restricted API endpoints. Rooted in CWE-862 (Missing Authorization), the flaw enables callers to interact with functionality gated behind access control levels that are incorrectly enforced - resulting in limited unauthorized data read and write operations against affected WooCommerce-backed mobile API deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS vector confirms the attack requires no authentication or special conditions.
Authentication bypass in FluxBuilder's MStore API WordPress plugin (versions through 4.18.4) allows unauthenticated remote attackers to exploit the password recovery flow as an alternate authentication channel, circumventing normal credential verification. Confirmed by Patchstack under CWE-288, the flaw enables unauthorized manipulation of user account state with low integrity and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable conditions from the network without any authentication.