CVE-2026-3568 is an authorization bypass vulnerability (CWE-639) in the MStore API WordPress plugin's update_user_profile() function. The function reads raw JSON input from php://input, decodes it, authenticates the user via cookie validation, and then updates user meta fields directly from the user-supplied 'meta_data' array without any validation or restrictions. This allows authenticated users with Subscriber-level privileges or higher to modify arbitrary meta keys on their own accounts, including sensitive fields like wp_user_level and plugin-specific authorization flags. The vulnerability does not allow direct exploitation of wp_capabilities due to serialization requirements but does permit privilege escalation via wp_user_level and potential stored XSS through unsanitized profile fields. The vulnerability affects all versions up to and including 4.18.3. No patch or official remediation has been disclosed as of the publication date.

An authenticated attacker with Subscriber-level access or higher can modify arbitrary user meta fields on their own account, including sensitive authorization and profile fields. This can lead to privilege escalation to administrator-level roles via manipulation of wp_user_level, unauthorized activation or deactivation of plugin-specific features, and potential stored cross-site scripting (XSS) in administrative contexts. The vulnerability does not impact confidentiality or availability directly but poses a risk to integrity and authorization controls within the affected WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious changes to user meta fields. Avoid granting Subscriber-level or higher access to untrusted users. Consider implementing custom validation or sanitization of user meta updates if feasible. Follow updates from the vendor for an official patch or temporary workaround.