Missing Authorization in FluxBuilder MStore API

Executive Summary

CVE-2026-57375 is a Broken Access Control vulnerability in the WordPress MStore API Plugin versions 4.18.4 and below. It occurs due to missing authorization checks, which allows unauthenticated users to perform actions that normally require higher privileges.

This means that attackers can exploit incorrectly configured access control security levels to gain unauthorized access or perform unauthorized actions within the affected plugin.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability allows unauthenticated users to perform actions requiring higher privileges due to missing authorization checks in the MStore API Plugin versions 4.18.4 and below.

Detection can involve monitoring for unauthorized access attempts or unusual API calls that should require authentication but are accepted without it.

Specific commands or detection scripts are not provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to perform privileged actions without proper authorization, potentially compromising the security of your website.

It is considered moderately dangerous and may be exploited in mass campaigns targeting many websites, increasing the risk of widespread attacks.

Until the plugin is updated to version 4.19.0, your site remains vulnerable, but mitigation rules are available to block attacks temporarily.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability, involving missing authorization and broken access control, can have significant implications for compliance with standards and regulations like GDPR and HIPAA.

• GDPR: The vulnerability allows unauthenticated users to perform actions requiring higher privileges, which could lead to unauthorized access to personal data. Under GDPR, organizations must implement appropriate technical measures to ensure data protection. Failure to do so may result in violations of Article 5 (principles relating to processing of personal data), Article 25 (data protection by design and by default), and Article 32 (security of processing), potentially leading to fines or legal action.
• HIPAA: For organizations handling protected health information (PHI), this vulnerability could enable unauthorized access to sensitive patient data. HIPAA requires covered entities to implement access controls (45 CFR § 164.308(a)(4)) and ensure that only authorized individuals can access PHI. A breach resulting from this vulnerability could lead to non-compliance with the Security Rule, resulting in penalties.

Additionally, the lack of proper access controls may violate other industry-specific regulations or frameworks that mandate strict authorization mechanisms, such as PCI DSS for payment data or ISO 27001 for information security management.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended step is to update the MStore API Plugin to version 4.19.0 or later, which contains the patch for this vulnerability.

Until the update can be applied, Patchstack offers a mitigation rule to block attacks exploiting this vulnerability.

Applying such mitigation rules and promptly updating the plugin are critical to reducing the risk of exploitation.

Useful 0 Not Useful 0