MStore API – Create Native Android & iOS Apps On The Cloud

MStore API – Create Native Android & iOS Apps On The Cloud has 38 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 38 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 14 critical and 3 high. 2023 was the busiest year with 17 disclosures.

The most common weakness is Authentication Bypass Using An Alternate Path Or Channel, behind 8 of the records (21%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 38 issues recorded for MStore API – Create Native Android & iOS Apps On The Cloud has a vendor fix available, so running the current release closes all known holes.

20 independent researchers contributed these findings, most of them (14) reported by Truoc Phan. MStore API – Create Native Android & iOS Apps On The Cloud is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

7.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-13447

MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

Read the full analysis

Vulnerability Records

38 records


2026-09-04 17:19	MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery MStore API <= 4.20.0	`CVE-2026-13447`	9.8 Critical	t4g0	Yes
2026-08-27 00:00	MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization MStore API < 4.21.1	`CVE-2026-18234`	6.3 Medium	Erwan LR	Yes
2026-08-27 00:00	MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion MStore API < 4.21.1	`CVE-2026-18233`	4.3 Medium	Erwan LR	Yes
2026-08-11 00:00	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation MStore API <= 4.20.0	`CVE-2026-27543`	9.8 Critical	Taylsec	Yes
2026-08-03 00:00	MStore API <= 4.20.0 - Missing Authorization MStore API <= 4.20.0	`CVE-2026-16038`	5.3 Medium	Sai Praneeth Koti	Yes
2026-08-03 00:00	MStore API <= 4.20.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure MStore API <= 4.20.0	`CVE-2026-16039`	4.3 Medium	Sai Praneeth Koti	Yes
2026-08-03 00:00	MStore API <= 4.20.0 - Missing Authorization MStore API <= 4.20.0	`CVE-2026-16041`	5.3 Medium	Usama Arshad	Yes
2026-07-07 00:00	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization MStore API <= 4.18.4	`CVE-2026-57375`	5.3 Medium	Nguyen Dinh Hai (HaiND)	Yes
2026-06-17 00:00	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization MStore API <= 4.18.4	`CVE-2026-54817`	5.3 Medium	Jakub Herman	Yes
2026-04-08 00:00	MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update MStore API <= 4.18.3	`CVE-2026-3568`	4.3 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes

Showing 1–10 of 38 reports

Latestv4.21.3

MStore API – Create Native Android & iOS Apps On The Cloud

Author

FluxBuilder

3.7(21)

74/100

Last Updated

2026-08-20 (24d ago)

Active Installs

2,000+

Downloads

307,999

Requires WP

4.4+

Requires PHP

Tested up to

WP 7.1

Created

2019-09-23 (7y ago)

Take your WordPress store mobile with MStore API! This plugin bridges the gap between your WordPress website and the powerful FluxBuilder app builder. By enabling the REST API, MStore API seamlessly connects your store data (products, users, orders) to FluxBuilder App, allowing you to create a custom mobile app for your business without writing any code. Key benefits: Effortless mobile app creation: Leverage FluxBuilder’s drag-and-drop interface and pre-built templates to design your dream mobile app. Seamless data integration: MStore API ensures smooth communication between your WordPress store and the mobile app, keeping product information, user accounts, and orders in sync. Enhanced customer experience: Offer a convenient mobile shopping experience to your customers, boosting engagement and sales. Ready to go mobile? Download the MStore API plugin and unlock the power of FluxBuilder for your WordPress store! Reference links FluxBuilder – Flutter App Builder: https://www.fluxbuilder.com Guide to use: docs.fluxbuilder.com Download The App Builder: fluxbuilder.com/download Showcase: https://showcase.fluxbuilder.com YouTube Facebook Document

View on WordPress.org