Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · mstore-api
mstore-api
41 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 2, 2026MStore API: Does not restrictCVE-2026-97219 · fixed in 4.22.1 · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Sep 5, 2026Mstore Api: Authentication BypassCVE-2026-13447 · affects up to 4.20.0 · reported by WordfenceCritical 9.8
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2026MStore API: Does not verify that the order targeted by its wallet payment handling belongs to the requesterCVE-2026-18234 · fixed in 4.21.1 · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
Aug 29, 2026MStore API: Does not verify that the order targeted by one of its delivery endpoints belongs to the requesterCVE-2026-18233 · fixed in 4.21.1 · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
Aug 13, 2026Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.CVE-2026-27543 · affects up to 4.20.0 · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
Aug 7, 2026MStore API: Does not perform authorization or purchase-ownership checks on its REST product-review creation routeCVE-2026-16041 · fixed in 4.21.0 · reported by WPScanHigh 7.5
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Aug 7, 2026MStore API: Does not restrict its vendor-orders endpoint to the caller's own ordersCVE-2026-16039 · fixed in 4.21.0 · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Aug 7, 2026MStore API: Does not verify the payment with the payment gateway before marking an orderCVE-2026-16038 · fixed in 4.21.0 · reported by WPScanCritical 9.1
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Aug 7, 2026MStore API: Does not correctly verify the cryptographic signature of the token used to authenticate its phone-based loginCVE-2026-16030 · fixed in 4.21.0 · reported by WPScanHigh 8.1
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Jul 13, 2026MStore API: Missing AuthorizationCVE-2026-57375 · affects up to 4.18.4 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.
Jun 17, 2026MStore API: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-54817 · affects up to 4.18.4 · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
May 10, 2026WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requeCVE-2021-47933 · reported by VulnCheckCritical 9.3
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
Apr 9, 2026MStore API: Insecure Direct Object ReferenceCVE-2026-3568 · affects up to 4.18.3 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp_user_level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., _wpuf_user_active, aiowps_account_status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp_capabilities cannot be directly exploited this way because it requires a serialized array value, but wp_user_level (
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · affects up to 4.17.5 · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Limited privilege escalationCVE-2025-3438 · affects up to 4.17.4 · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Stored Cross-Site ScriptingCVE-2024-12042 · affects up to 4.16.4 · reported by WordfenceMedium 5.4
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024MStore API – Create Native Android & iOS Apps On The Cloud: SQL InjectionCVE-2024-11179 · affects up to 4.15.7 · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized user registrationCVE-2024-8269 · affects up to 4.15.3 · reported by WordfenceHigh 7.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Arbitrary file uploadsCVE-2024-8242 · affects up to 4.15.3 · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-7628 · affects up to 4.15.2 · reported by WordfenceHigh 8.1
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-6328 · affects up to 4.14.7 · reported by WordfenceCritical 9.8
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 29, 2023MStore API: Cross-Site Request Forgery (CSRF)CVE-2023-50878 · affects up to 4.10.1 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.
Nov 6, 2023MStore API: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45055 · affects up to 4.0.6 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from n/a through 4.0.6.
Nov 3, 2023MStore API: Unauthorized Account Access and Privilege EscalationCVE-2023-3277 · affects up to 4.10.7 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3202 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3199 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3209 · fixed in 3.9.7 · reported by WPScanLow 3.5
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3131 · fixed in 3.9.7 · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · fixed in 3.9.8 · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Jul 10, 2023MStore API: Does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpointCVE-2023-3076 · fixed in 3.9.9 · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Jun 23, 2023MStore API: Unauthenticated Blind SQL InjectionCVE-2023-3197 · affects up to 4.0.1 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jun 23, 2023Unauth.CVE-2022-47614 · affects up to 3.9.7 · reported by PatchstackHigh 7.5
Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3203 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3201 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3200 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3198 · affects up to 3.9.6 · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2023MStore API: Authentication bypassCVE-2020-36713 · affects up to 2.1.5 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
May 24, 2023MStore API: Authentication bypassCVE-2023-2734 · affects up to 3.9.1 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 24, 2023MStore API: Authentication bypassCVE-2023-2733 · affects up to 3.9.0 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 24, 2023MStore API: Authentication bypassCVE-2023-2732 · affects up to 3.9.2 · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 18, 2021A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated CVE-2021-24148 · fixed in 3.2.0 · reported by WPScanCritical 9.8
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.