Introduction
An unauthenticated arbitrary file upload vulnerability in the WordPress MStore API plugin lets any remote attacker upload and execute PHP code on the server without credentials. A public exploit has been available since October 2021, and no authentication is required, so this is a direct path to full server compromise for the roughly 3,000 WordPress sites running vulnerable versions.
The MStore API plugin, developed by InspireUI, connects WordPress WooCommerce stores to native mobile apps built with the FluxBuilder platform. It exposes product, user, and order data through REST API endpoints that power mobile storefronts. Its install base of about 3,000 active sites is modest, but each installation usually runs an e-commerce operation handling customer data and payment information.
Technical Information
Root Cause: Missing Authentication (CWE-306)
The vulnerability comes from CWE-306, Missing Authentication for Critical Function. The MStore API plugin registers a REST API endpoint at /wp-json/api/flutter_woo/config_file that accepts file uploads through POST requests. This endpoint performs no authentication or authorization checks at all. Any unauthenticated user can submit a file upload request, and the server will process and store the file.
Attack Flow
The exploitation process is simple and fully automatable:
-
Target Discovery: An attacker identifies WordPress sites running the MStore API plugin. The public exploit includes a Google Dork for this purpose:
inurl:/wp-content/plugins/mstore-api/. -
Crafted Upload Request: The attacker sends a POST request to the vulnerable endpoint, uploading a PHP webshell. The file is given a name like
config.json.phpand submitted with a content type ofapplication/jsonto bypass superficial file type checks. -
Server Response: The server accepts the upload without authentication and returns the location of the stored file.
-
Code Execution: The attacker opens the uploaded PHP file's URL and runs arbitrary commands on the underlying server.
The public exploit by the author spacehen shows the core of this attack:
rest_url = '/wp-json/api/flutter_woo/config_file' files = {'file' : ( "config.json.php", open(file_path), "application/json" )}
The name config.json.php is deliberate. The double extension makes the file look like a JSON configuration file while the web server interprets and executes it as PHP. The application/json content type reinforces the disguise at the request level.
Impact
Successful exploitation gives the attacker remote code execution on the web server. From there, an attacker can read database credentials from wp-config.php, exfiltrate customer and order data, install persistent backdoors, pivot to other systems on the network, or use the compromised server for further attacks.
Affected Systems and Versions
The vulnerability affects MStore API version 2.0.6 and below. The current stable release of the plugin is version 4.18.4, tested up to WordPress 6.9.0, according to the WordPress plugin repository.
Any WordPress installation running MStore API 2.0.6 or earlier with the REST API accessible, which is the default WordPress configuration, is vulnerable. No special configuration is needed for it to be exploitable.
Vendor Security History
InspireUI's MStore API plugin has a clear pattern of critical security issues, especially around authentication and access control:
| Vulnerability Type | Affected Versions | Impact |
|---|---|---|
| Arbitrary File Upload (CVE-2021-47933) | 2.0.6 and below | Remote Code Execution |
| Authentication Bypass (CVE-2023-2732) | 3.9.2 and below | Unauthorized Access |
| SQL Injection | Below 3.9.8 | Database Compromise |
| Privilege Escalation | 4.10.7 and below | Unauthorized Account Access |
Authentication and authorization failures recur across multiple versions, which points to a systemic weakness in the plugin's security architecture. Administrators running this plugin should treat it as a high priority for patch management and monitoring.
