Missing Authorization in FluxBuilder MStore API

Executive Summary

CVE-2026-57375 is a Broken Access Control vulnerability in the WordPress MStore API Plugin versions 4.18.4 and below. It occurs due to missing authorization checks, which allows unauthenticated users to perform actions that normally require higher privileges.

This means that attackers can exploit incorrectly configured access control security levels to gain unauthorized access or perform unauthorized actions within the affected plugin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to perform privileged actions without proper authorization, potentially compromising the security of your website.

It is considered moderately dangerous and may be exploited in mass campaigns targeting many websites, increasing the risk of widespread attacks.

Until the plugin is updated to version 4.19.0, your site remains vulnerable, but mitigation rules are available to block attacks temporarily.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability allows unauthenticated users to perform actions requiring higher privileges due to missing authorization checks in the MStore API Plugin versions 4.18.4 and below.

Detection can involve monitoring for unauthorized access attempts or unusual API calls that should require authentication but are accepted without it.

Specific commands or detection scripts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended step is to update the MStore API Plugin to version 4.19.0 or later, which contains the patch for this vulnerability.

Until the update can be applied, Patchstack offers a mitigation rule to block attacks exploiting this vulnerability.

Applying such mitigation rules and promptly updating the plugin are critical to reducing the risk of exploitation.

Useful 0 Not Useful 0