CVE-2026-57375: MStore API Authorization Bypass Flaw

CVE-2026-57375 Overview

CVE-2026-57375 is a missing authorization vulnerability in the FluxBuilder MStore API plugin for WordPress. The flaw affects all versions of mstore-api up to and including 4.18.4. The plugin exposes REST endpoints with incorrectly configured access control, allowing unauthenticated network attackers to interact with functionality that should be restricted. The weakness is classified under [CWE-862] Missing Authorization. MStore API is widely deployed on WordPress sites that power Flutter-based mobile commerce apps, expanding the potential attack surface across production e-commerce environments.

Critical Impact
Unauthenticated attackers can reach protected plugin functionality over the network, exposing limited confidentiality and integrity risks on WordPress sites running MStore API 4.18.4 or earlier.

Affected Products

FluxBuilder MStore API (mstore-api) plugin for WordPress
All versions up to and including 4.18.4
WordPress sites integrating MStore API for Flutter mobile commerce backends

Discovery Timeline

2026-07-13 - CVE-2026-57375 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57375

Vulnerability Analysis

The MStore API plugin exposes REST API endpoints that back Flutter mobile storefronts. One or more of these endpoints omit proper capability or authentication checks before executing sensitive operations. An attacker sends crafted HTTP requests directly to the plugin's REST routes and reaches functionality intended for authenticated roles. Because the flaw is reachable over the network with no privileges and no user interaction, exploitation requires only knowledge of the vulnerable endpoint. The impact is bounded to limited confidentiality and integrity exposure, with no direct effect on availability. According to Patchstack, this constitutes a broken access control condition in the plugin.

Root Cause

The root cause is missing authorization logic on plugin REST routes. The vulnerable handlers either omit a permission_callback or supply one that always returns true, which is a common WordPress REST API misconfiguration. Without a capability check such as current_user_can(), WordPress treats the request as authorized regardless of the caller's identity. See the Patchstack Vulnerability Report for endpoint-specific details.

Attack Vector

An unauthenticated attacker sends HTTP requests to the affected REST endpoints exposed under the /wp-json/ namespace registered by MStore API. The attacker does not need a valid session, nonce, or user account. Successful requests invoke plugin functions that read or modify data the caller should not access, producing the observed low confidentiality and integrity impact.

No verified public exploit code is available. Refer to the vendor advisory for endpoint-specific technical details.

Detection Methods for CVE-2026-57375

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/api/ or other MStore API-registered REST routes from unfamiliar source addresses
HTTP 200 responses to REST calls that would normally require an authenticated wp_rest nonce
Unexpected content, product, order, or configuration changes on WordPress sites running mstore-api<= 4.18.4
New administrative or subscriber accounts created without a corresponding admin session in access logs

Detection Strategies

Inventory WordPress installations and identify sites running mstore-api at version 4.18.4 or earlier
Correlate WordPress REST API access logs with authentication events to surface anonymous calls to protected endpoints
Deploy web application firewall signatures that flag unauthenticated requests to MStore API REST paths
Baseline normal Flutter mobile app request patterns and alert on deviations targeting plugin endpoints

Monitoring Recommendations

Forward WordPress access, error, and audit logs to a centralized log platform for retention and query
Alert on spikes in /wp-json/ traffic without accompanying authenticated sessions
Monitor plugin file integrity and database changes in wp_options, wp_users, and wp_posts
Track outbound connections from the WordPress host that could indicate post-exploitation activity

How to Mitigate CVE-2026-57375

Immediate Actions Required

Identify every WordPress site running mstore-api and confirm the installed version
Update MStore API to a version later than 4.18.4 once the vendor publishes a fixed release
Restrict access to /wp-json/ endpoints at the WAF or reverse proxy where the mobile app source ranges are known
Review WordPress user, order, and content tables for unauthorized changes since the plugin was installed

Patch Information

The advisory identifies all versions of MStore API through 4.18.4 as vulnerable. Administrators should consult the Patchstack Vulnerability Report and the FluxBuilder plugin changelog for the fixed release version, then upgrade through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate the MStore API plugin on sites that do not require the Flutter mobile backend until a patch is applied
Block unauthenticated requests to MStore API REST routes at the WAF using explicit path rules
Enforce IP allowlisting on /wp-json/ for sites where the mobile client egress addresses are known
Rotate WordPress secrets in wp-config.php and administrative credentials after confirming a patch is applied

bash

# Example WP-CLI check and update workflow
wp plugin get mstore-api --field=version
wp plugin update mstore-api
wp plugin deactivate mstore-api  # if a fixed version is not yet available