[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi9n47oi1btP0SJS5vusg9atPCbhqs-oahjiK0CROb50":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":31},"CVE-2026-57375","mstore-api-create-native-android-ios-apps-on-the-cloud-missing-authorization-2","MStore API – Create Native Android & iOS Apps On The Cloud \u003C= 4.18.4 - Missing Authorization","The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.18.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.","mstore-api",null,"\u003C=4.18.4","4.19.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-07 00:00:00","2026-07-14 19:51:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbeae9073-5293-4a89-8c9a-8c5276891684?source=api-prod",8,[],"researched",false,3,"This research plan targets **CVE-2026-57375**, a Missing Authorization vulnerability in the **MStore API** plugin (versions \u003C= 4.18.4). Based on the CVSS vector (I:L, C:N), the vulnerability likely allows unauthenticated attackers to modify specific plugin configurations or user-related data without proper permission checks.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Missing Authorization.\n*   **Plugin:** MStore API – Create Native Android & iOS Apps On The Cloud (`mstore-api`).\n*   **Afected Versions:** \u003C= 4.18.4.\n*   **Description:** The plugin registers REST API endpoints or AJAX handlers intended for app synchronization or user management but fails to implement `permission_callback` (for REST) or capability checks (for AJAX). This allows unauthenticated users to trigger functions that modify site state.\n\n### 2. Attack Vector Analysis\n*   **Endpoint Type:** Likely a WordPress REST API route (registered via `register_rest_route`) or an unauthenticated AJAX action (`wp_ajax_nopriv_`).\n*   **Route Namespace (inferred):** `mstore\u002Fv1` or `mstore-api\u002Fv1`.\n*   **Authentication:** None required (unauthenticated).\n*   **Preconditions:** The plugin must be active. Some endpoints may require a specific plugin setting to be enabled (e.g., \"Enable App Login\").\n\n### 3. Code Flow (Discovery Phase)\nThe agent must first locate the vulnerable entry point.\n\n1.  **Identify REST Routes:** Search for route registrations that lack proper authorization.\n    *   Command: `grep -rn \"register_rest_route\" wp-content\u002Fplugins\u002Fmstore-api\u002F`\n    *   Look for: Routes where `'permission_callback'` is missing, set to `__return_true`, or set to a function that doesn't use `current_user_can()`.\n\n2.  **Identify AJAX Handlers:** Search for unauthenticated AJAX actions.\n    *   Command: `grep -rn \"wp_ajax_nopriv_\" wp-content\u002Fplugins\u002Fmstore-api\u002F`\n    *   Trace the callback function to check for `current_user_can()` or `check_ajax_referer()`.\n\n3.  **Target Functionality:** Focus on functions that perform `update_option()`, `update_user_meta()`, or `wp_insert_user()`.\n    *   Command: `grep -rnE \"update_option|update_user_meta|wp_insert_user\" wp-content\u002Fplugins\u002Fmstore-api\u002F`\n\n### 4. Nonce Acquisition Strategy\nWhile many REST routes in this plugin may skip nonces entirely for mobile compatibility, some might require the standard `wp_rest` nonce.\n\n1.  **Check Requirement:** Inspect the `permission_callback`. If it is absent, no nonce is typically required for unauthenticated REST access.\n2.  **Extraction (if needed):**\n    *   Identify a shortcode that enqueues MStore scripts (e.g., `[mstore_info]` or similar, found via `grep -r \"add_shortcode\"`).\n    *   Create a test page: `wp post create --post_type=page --post_status=publish --post_content='[SHORTCODE_NAME]'`\n    *   Navigate to the page and extract the nonce using `browser_eval`:\n        `window.mstore_vars?.nonce` or check the `wp-json` header.\n\n### 5. Exploitation Strategy\nBased on common patterns in this plugin, the vulnerability likely resides in a \"Settings Sync\" or \"User Registration\" endpoint.\n\n#### Scenario A: Unauthorized Settings Update (Integrity: Low)\nIf a route like `POST \u002Fwp-json\u002Fmstore\u002Fv1\u002Fsettings` exists:\n*   **Endpoint:** `http:\u002F\u002Fvulnerable-test.local\u002Fwp-json\u002Fmstore\u002Fv1\u002Fsettings`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fjson`\n*   **Payload:**\n    ```json\n    {\n        \"mstore_app_config\": {\n            \"firebase_server_key\": \"attacker-key\",\n            \"facebook_app_id\": \"123456789\"\n        }\n    }\n    ```\n\n#### Scenario B: Unauthorized User Meta Modification\nIf a route like `POST \u002Fwp-json\u002Fmstore\u002Fv1\u002Fuser\u002Fupdate` exists:\n*   **Endpoint:** `http:\u002F\u002Fvulnerable-test.local\u002Fwp-json\u002Fmstore\u002Fv1\u002Fuser\u002Fupdate`\n*   **Payload:**\n    ```json\n    {\n        \"user_id\": 1,\n        \"meta_key\": \"some_privilege_flag\",\n        \"meta_value\": \"true\"\n    }\n    ```\n\n### 6. Test Data Setup\n1.  **Install Plugin:** Ensure `mstore-api` v4.18.4 is installed and active.\n2.  **Identify Target Setting:** Determine a non-critical but modifiable option (e.g., the \"App Name\" or \"Primary Color\" in the plugin settings).\n3.  **Create Page (if nonce needed):** Find the script-loading shortcode and place it on a page.\n\n### 7. Expected Results\n*   **Success Response:** The server returns `200 OK` or `201 Created`, often with a JSON body like `{\"status\": \"success\"}` or echoing the updated values.\n*   **Vulnerability Confirmation:** The modified setting or user meta persists in the database.\n\n### 8. Verification Steps\n1.  **Check Options:** Use WP-CLI to see if the targeted option changed.\n    *   `wp option get mstore_app_config`\n2.  **Check User Meta:**\n    *   `wp user meta get 1 some_privilege_flag`\n3.  **Log Inspection:** Check for lack of \"401 Unauthorized\" or \"403 Forbidden\" responses in the access logs during the unauthenticated request.\n\n### 9. Alternative Approaches\n*   **Method Override:** If `POST` is blocked, try `GET` with parameters or use the `X-HTTP-Method-Override: POST` header.\n*   **Search for Configuration Sync:** Many mobile plugins have an \"Import\u002FExport\" or \"Sync\" feature that uses a simple token (or no token) to overwrite settings. Search for `json_decode(file_get_contents('php:\u002F\u002Finput'))` in files related to \"Sync\" or \"Cloud\".\n*   **Check for `_wpnonce` bypass:** See if the code calls `check_ajax_referer` but passes `false` as the third argument (die) and fails to check the return value.","The MStore API plugin for WordPress fails to implement proper authorization checks on certain functional endpoints in versions up to and including 4.18.4. This vulnerability allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin-specific configurations or user metadata, by directly accessing unprotected REST API routes or AJAX handlers.","An attacker targets unauthenticated REST API routes (typically within the mstore\u002Fv1 namespace) or AJAX handlers that lack a 'permission_callback' or 'current_user_can' check. By sending a POST request to these endpoints with a specific payload, the attacker can trigger internal functions that update site options or user metadata. No authentication or valid nonces are required to successfully execute these requests if the endpoint is fully unprotected.","gemini-3-flash-preview","2026-07-25 09:13:08","2026-07-25 09:13:48",{"type":32,"vulnerable_version":33,"fixed_version":9,"vulnerable_browse":34,"vulnerable_zip":35,"fixed_browse":9,"fixed_zip":9,"all_tags":36},"plugin","4.18.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmstore-api\u002Ftags\u002F4.18.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmstore-api.4.18.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmstore-api\u002Ftags"]