CVE-2026-3568

OVERVIEW The MStore API plugin for WordPress versions up to 4.18.3 contains an Insecure Direct Object Reference vulnerability in the update_user_profile() function. The vulnerability exists because the function processes user-supplied meta_data JSON parameters without validation, allowlisting, or sanitization, allowing authenticated users to modify arbitrary user metadata fields. SEVERITY The vulnerability requires network access and low privilege (Subscriber-level or above) to exploit, with low attack complexity and no user interaction needed. While the CVSS score of 4.3 (Medium) reflects limited direct impact, the actual risk is noteworthy: authenticated attackers can escalate privileges through the wp_user_level field, disable security features via plugin-specific authorization flags, or inject unsanitized values that may enable Stored XSS attacks in administrative contexts. The vulnerability cannot directly compromise the wp_capabilities field due to serialization requirements, but numerous alternative exploitation paths exist. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list. The EPSS score of 0.00036 indicates minimal real-world exploitation likelihood. However, the straightforward nature of the vulnerability and clear attack vector may attract opportunistic exploitation, particularly given that proof-of-concept exploitation would be relatively straightforward for authenticated users with basic plugin knowledge.