CVE-2026-54817: MStore API Auth Bypass Vulnerability

CVE-2026-54817 Overview

CVE-2026-54817 is an authentication bypass vulnerability in the FluxBuilder MStore API plugin for WordPress. The flaw is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel) and affects all versions up to and including 4.18.4. Attackers can abuse the plugin's password recovery flow to bypass authentication and act against user accounts without valid credentials. The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. MStore API is widely deployed on WooCommerce sites to power Flutter-based mobile commerce applications, expanding the potential attack surface across e-commerce deployments.

Critical Impact
An unauthenticated remote attacker can exploit the password recovery path to bypass authentication controls in MStore API versions through 4.18.4, enabling account takeover scenarios on affected WordPress sites.

Affected Products

FluxBuilder MStore API plugin for WordPress
All versions from initial release through 4.18.4
WooCommerce sites integrating MStore API for mobile app backends

Discovery Timeline

2026-06-17 - CVE-2026-54817 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54817

Vulnerability Analysis

The vulnerability resides in the password recovery functionality exposed by the MStore API plugin. The plugin provides REST endpoints intended to serve mobile commerce applications, including endpoints that handle account recovery. Because these endpoints implement an alternate authentication channel separate from the standard WordPress login flow, weaknesses in their verification logic permit attackers to bypass authentication entirely. The flaw allows limited impact to integrity and availability, consistent with account-level manipulation rather than full system compromise. Refer to the Patchstack Vulnerability Advisory for further technical context.

Root Cause

The root cause is improper validation in the password recovery channel exposed through the plugin's REST API. The recovery path accepts requests without enforcing the same identity and authorization checks present elsewhere, allowing attackers to invoke recovery actions outside the intended workflow. This matches the [CWE-288] pattern, where a secondary channel bypasses the primary authentication mechanism.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable MStore API password recovery endpoint over the network. No prior authentication, privileges, or user interaction are required. Successful exploitation enables the attacker to manipulate account credentials or trigger recovery actions, leading to unauthorized access against targeted WordPress user accounts.

No verified public exploit code is available at this time. Defenders should refer to the Patchstack Vulnerability Advisory for the authoritative technical breakdown.

Detection Methods for CVE-2026-54817

Indicators of Compromise

Unexpected HTTP requests to MStore API REST routes under /wp-json/api/flutter_user/ related to password recovery
Successful password reset events for user accounts without corresponding user-initiated activity
New or modified administrator and customer accounts following anomalous API traffic
Outbound mail traffic for password reset notifications that do not correlate to legitimate sessions

Detection Strategies

Inspect WordPress and web server access logs for unauthenticated POST requests targeting MStore API recovery endpoints
Correlate WordPress user_meta and password_reset events with originating IP and user-agent patterns
Alert on bursts of password recovery requests from a single source against multiple accounts
Compare installed MStore API plugin version against the fixed release using inventory scanning

Monitoring Recommendations

Forward WordPress, WooCommerce, and web server logs to a centralized analytics platform for long-term retention
Establish baselines for normal /wp-json/ API traffic volume and alert on deviations
Monitor administrative user creation, role changes, and password resets in near real time
Track plugin version state across all WordPress hosts to identify unpatched instances

How to Mitigate CVE-2026-54817

Immediate Actions Required

Identify all WordPress sites running the FluxBuilder MStore API plugin and confirm installed versions
Update MStore API to a release later than 4.18.4 once the vendor publishes a patched version
Force a password reset for privileged accounts on sites suspected of exposure
Audit recent password recovery activity and account modifications for signs of abuse

Patch Information

Review the Patchstack Vulnerability Advisory for the latest patched version guidance from FluxBuilder. Apply the vendor-supplied update through the WordPress plugin manager once available, and verify the version reflects a release greater than 4.18.4.

Workarounds

Restrict access to MStore API REST endpoints at the web application firewall or reverse proxy layer until a patch is applied
Temporarily deactivate the MStore API plugin on sites where mobile app integration is non-critical
Apply IP allowlisting to the /wp-json/api/ routes used by trusted mobile clients
Enforce multi-factor authentication for WordPress administrators to limit downstream impact of account compromise

bash

# Example: block external access to MStore API recovery routes via nginx
location ~* /wp-json/api/flutter_user/(forgot_password|reset_password) {
    allow 10.0.0.0/8;
    deny all;
}