We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

MStore API Plugin Vulnerability (CVE-2026-3568)

Nick Paliughi
On this page

Security Alert Summary

The MStore API plugin for WordPress contains an Insecure Direct Object Reference vulnerability that allows authenticated users with Subscriber-level access or higher to modify arbitrary user meta on their own accounts. The issue stems from insufficient validation of a JSON meta_data parameter in the plugin’s user update routine, which can be used to change fields such as wp_user_level and various plugin-specific authorization flags, and may enable stored XSS in administrative contexts.

CVE Details

  • CVE ID: CVE-2026-3568
  • Affected component: MStore API plugin for WordPress
  • Affected versions: All versions up to, and including, 4.18.3
  • Published: April 9, 2026 4:16:59 AM
  • Last modified: April 9, 2026 4:16:59 AM
  • CVSS v3.1: Base Score 4.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • Authentication / privileges: Requires an authenticated user with low privileges (PR:L). The vendor report notes Subscriber-level access and above can exploit this behavior.
  • User interaction: None (UI:N)
  • Primary impact:
    • Confidentiality: None
    • Integrity: Low (unauthorized modification of user meta on the caller’s account)
    • Availability: None
  • Weakness: CWE-639 (Authorization Bypass Through User-Controlled Key)

Technical Details

The vulnerability stems from the update_user_profile() function in controllers/flutter-user.php. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), performs cookie-based authentication (line 1015), and then iterates over the supplied meta_data array, passing user-provided keys and values directly to update_user_meta() (line 1080) without any allowlist, blocklist, validation, or sanitization.

Because the plugin does not restrict which meta keys can be updated, authenticated users can modify arbitrary meta fields on their own account. The report notes that wp_user_level (a simple integer) is modifiable and can affect legacy capability checks, and that various plugin-specific authorization flags (for example _wpuf_user_active, aiowps_account_status) and billing/profile fields can be altered with unsanitized values. wp_capabilities is not directly exploitable via this vector without a correctly serialized array value.

The practical effect is unauthorized modification of a user’s own metadata and the potential for stored XSS in administrative contexts when unsanitized profile or billing fields are rendered in admin pages. The vulnerability does not, based on the provided data, indicate arbitrary modification of other users’ meta or arbitrary file/system access.

How This Could Impact Your Website

Consider a site with multiple WordPress users: a site owner, several internal staff members with Editor or Author roles, and external contributors or contractors who have Subscriber-level accounts. An authenticated subscriber could use the vulnerable endpoint to change metadata on their own account. Practical consequences include ability to alter legacy-level indicators like wp_user_level (potentially affecting plugins or themes that rely on legacy checks) and to inject unsanitized profile fields that might be displayed in admin contexts, leading to stored XSS opportunities.

Those changes could increase the risk of targeted phishing or social engineering against site administrators if user-facing profile data is manipulated, or allow an attacker to influence plugin-specific authorization flags that gate functionality. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributors and subscribers who do not need user-facing profile update capabilities.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and administrative pages for unusual behavior or unexpected profile field content.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
List category posts plugin Vulnerability (CVE-2026-3005)
Next Post
Bookly Plugin Vulnerability (CVE-2026-2519)