CVE-2026-3568: MStore API IDOR in update_user_profile

CVE-2026-3568 · Severity: medium · CVSS 4.3 · Published 2026-04-09

The MStore API plugin for WordPress, which helps build mobile apps for websites, contains a security flaw that allows logged-in users to modify their own account settings. An attacker with a basic account could change sensitive internal data fields to gain higher-level permissions or bypass certain security restrictions. This could lead to unauthorized access to administrative features or the injection of malicious scripts into the website's management interface.

Technologies: InspireUI MStore API. Vendors: InspireUI.

Quick answers

Is CVE-2026-3568 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3568 being exploited in the wild.
How severe is CVE-2026-3568?
Medium severity, with a CVSS score of 4.3, published 9 April 2026.
Which products and versions are affected?
InspireUI MStore API <= 4.18.3.
Is there a fix for CVE-2026-3568?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3568 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3568?
Check whether you run InspireUI MStore API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the update_user_profile() function in controllers/flutter-user.php. The function processes the 'meta_data' JSON parameter from php://input without implementing an allowlist or validating meta keys before passing them to the update_user_meta() function. An authenticated attacker with Subscriber-level access can exploit this to modify sensitive meta fields such as 'wp_user_level' for legacy privilege escalation or various plugin-specific authorization flags. Additionally, the lack of sanitization on these values may allow for Stored XSS in administrative contexts. A patch was released in version 4.18.4 (implied by the 'up to and including 4.18.3' range).

Affected products

  • inspireui MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.3

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.