Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-02
MStore API - Security Vulnerability (CVE-2026-97219)
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
PLUGIN
MStore API
CVE-2026-97219
Risk Score
Threat Entry
Updated 2026-09-08
Mstore Api - Authentication Bypass (CVE-2026-13447)
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting…
PLUGIN
Mstore Api
CVE-2026-13447
Risk Score
Threat Entry
Updated 2026-08-31
MStore API - Broken Access Control (CVE-2026-18234)
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
PLUGIN
MStore API
CVE-2026-18234
Risk Score
Threat Entry
Updated 2026-08-31
MStore API - Broken Access Control (CVE-2026-18233)
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
PLUGIN
MStore API
CVE-2026-18233
Risk Score
Threat Entry
Updated 2026-08-14
MStore API - Privilege Escalation (CVE-2026-27543)
Unauthenticated Privilege Escalation in MStore API
PLUGIN
MStore API
CVE-2026-27543
Risk Score
Threat Entry
Updated 2026-08-26
MStore API - Security Vulnerability (CVE-2026-16041)
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
PLUGIN
MStore API
CVE-2026-16041
Risk Score
Threat Entry
Updated 2026-08-26
MStore API - Security Vulnerability (CVE-2026-16039)
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
PLUGIN
MStore API
CVE-2026-16039
Risk Score
Threat Entry
Updated 2026-08-26
MStore API - Security Vulnerability (CVE-2026-16038)
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
PLUGIN
MStore API
CVE-2026-16038
Risk Score
Threat Entry
Updated 2026-08-26
MStore API - Security Vulnerability (CVE-2026-16030)
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
PLUGIN
MStore API
CVE-2026-16030
Risk Score
Threat Entry
Updated 2026-07-13
Mstore Api - Broken Access Control (CVE-2026-57375)
Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through
PLUGIN
Mstore Api
CVE-2026-57375
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Authentication Bypass (CVE-2026-54817)
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
PLUGIN
Mstore Api
CVE-2026-54817
Risk Score
Threat Entry
Updated 2026-07-25
Mstore Api - Remote Code Execution (CVE-2021-47933)
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
PLUGIN
Mstore Api
CVE-2021-47933
Risk Score
Threat Entry
Updated 2026-07-24
Mstore Api - Cross-Site Scripting (XSS) (CVE-2026-3568)
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes…
PLUGIN
Mstore Api
CVE-2026-3568
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Broken Access Control (CVE-2025-4683)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
PLUGIN
Mstore Api
CVE-2025-4683
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Privilege Escalation (CVE-2025-3438)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin…
PLUGIN
Mstore Api
CVE-2025-3438
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Cross-Site Scripting (XSS) (CVE-2024-12042)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
PLUGIN
Mstore Api
CVE-2024-12042
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - SQL Injection (CVE-2024-11179)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Mstore Api
CVE-2024-11179
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Security Vulnerability (CVE-2024-8269)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.
PLUGIN
Mstore Api
CVE-2024-8269
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Remote Code Execution (CVE-2024-8242)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
PLUGIN
Mstore Api
CVE-2024-8242
Risk Score
Threat Entry
Updated 2026-06-17
Mstore Api - Authentication Bypass (CVE-2024-7628)
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set…
PLUGIN
Mstore Api
CVE-2024-7628
Risk Score