CVE-2026-3568: MStore API: Insecure Direct Object Reference (CVSS 4.3)

MStore API: Insecure Direct Object Reference

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp_user_level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., _wpuf_user_active, aiowps_account_status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp_capabilities cannot be directly exploited this way because it requires a serialized array value, but wp_user_level (

Description from the National Vulnerability Database, published by Wordfence

What it means for a small business

MStore API is a WordPress plugin. If your website uses it, the flaw is on your site whether or not anyone has noticed yet: attackers scan the whole internet for the plugins with published flaws, usually within days of a record like this one going public.

Most small-business sites run 15 to 40 plugins, and few owners know the list. You can check from WordPress itself (Plugins, then Installed Plugins), or let our free plugin check look it up by name.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.23%, higher than 13% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored October 28, 2026, updated daily.

Check your own setup

Is MStore API safe? Every recorded flaw in it, the version that fixes each, and whether it’s still maintained.
Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.