CVE-2026-3568
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The MStore API plugin for WordPress up to version 4.18.3 has an IDOR vulnerability in the update_user_profile() function. An authenticated user with Subscriber access can modify arbitrary meta fields on their account, including sensitive ones like wp_user_level, without proper validation.
Risk Assessment
An attacker can escalate privileges (e.g., to administrator) or modify authorization-related fields, potentially leading to account takeover or XSS attacks.
Recommendation
Update the MStore API plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in MStore API
See all- CVE-2026-13447Critical
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0. This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
- CVE-2026-16038Critical
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
- CVE-2026-18234Medium
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods. This allows any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
- CVE-2026-18233Medium
The MStore API WordPress plugin before version 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester. This allows any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
- CVE-2026-27543High
Unauthenticated privilege escalation in MStore API versions up to 4.20.0. An attacker can elevate privileges without authentication.
- CVE-2026-16041High
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
- CVE-2026-16039Medium
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
- CVE-2026-16030High
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
- CVE-2026-57375Medium
The MStore API plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.18.4.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp_user_level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., _wpuf_user_active, aiowps_account_status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp_capabilities cannot be directly exploited this way because it requires a serialized array value, but wp_user_level (a simple integer) and numerous plugin-specific meta keys are exploitable.