Junglewise Threat Intelligence

CVE-2026-3568: MStore API IDOR in update_user_profile

CVE-2026-3568 · Severity: medium · CVSS 4.3 · Published 2026-04-09

Technologies: InspireUI MStore API. Vendors: InspireUI.

Executive brief

The MStore API plugin for WordPress, which helps build mobile apps for websites, contains a security flaw that allows logged-in users to modify their own account settings. An attacker with a basic account could change sensitive internal data fields to gain higher-level permissions or bypass certain security restrictions. This could lead to unauthorized access to administrative features or the injection of malicious scripts into the website's management interface.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the update_user_profile() function in controllers/flutter-user.php. The function processes the 'meta_data' JSON parameter from php://input without implementing an allowlist or validating meta keys before passing them to the update_user_meta() function. An authenticated attacker with Subscriber-level access can exploit this to modify sensitive meta fields such as 'wp_user_level' for legacy privilege escalation or various plugin-specific authorization flags. Additionally, the lack of sanitization on these values may allow for Stored XSS in administrative contexts. A patch was released in version 4.18.4 (implied by the 'up to and including 4.18.3' range).

Affected products

  • inspireui MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.3

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory

References

Related threats