PT-2026-31567 · Inspireui · Mstore Api – Create Native Android & Ios Apps On The Cloud
Published
2026-04-09
·
Updated
2026-04-09
·
CVE-2026-3568
CVSS v3.1
4.3
Medium
| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update user profile() function in controllers/flutter-user.php processing the 'meta data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta data array passing arbitrary keys and values to update user meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp user level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., wpuf user active, aiowps account status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp capabilities cannot be directly exploited this way because it requires a serialized array value, but wp user level (a simple integer) and numerous plugin-specific meta keys are exploitable.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mstore Api – Create Native Android & Ios Apps On The Cloud