Medium · 6.5 CVE-2026-54817 EUVD-2026-37706GHSA-vfmj-48r5-54j4

WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.

This issue affects MStore API: from n/a through 4.18.4.

Vendor	Product	Affected	Fixed
FluxBuilder	MStore API	≤ 4.18.4	—