MStore API – Create Native Android & iOS Apps On The Cloud

73 Quality Score

Active Installs

15/30

At 3,000 active installs it is a modest niche plugin, nowhere near mainstream, but it earns its popularity score above baseline thanks to a clear use case.

Update Freshness

25/25

Maintenance is a perfect 100: the plugin was last updated on 2026-06-12 and is tested against WordPress 7.0, signalling active upkeep.

User Rating

11/15

The 74/100 rating from 21 reviewers is decent but the small sample size means the average could swing noticeably with a few new reviews.

Support Health

8/15

Support health is concerning: 0 support threads opened and 0 resolved, so there is no public track record of how the developer handles troubleshooting.

WP Compatibility

15/15

Compatibility scores full marks: it works back to WordPress 4.4 and is confirmed against the current 7.0 release, and it requires no specific PHP version.

Scores higher than 32% of indexed plugins

About

Take your WordPress store mobile with MStore API! This plugin bridges the gap between your WordPress website and the powerful FluxBuilder app builder.

Active Installs 2k+

Rating ★★★½ 3.7/5

Last Updated 2026-09-24 9:20am GMT

Requires WordPress 4.4+

Tested Up To 7.1.2

Security History

38 known vulnerabilities, all patched

14 Critical 3 High 21 Medium

Most recent: September 4, 2026

View details ▸

MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery Critical

September 4, 2026 Patched in ["4.21.1"] CVE-2026-13447

MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion Medium

August 27, 2026 Patched in ["4.21.1"] CVE-2026-18233

MStore API – Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization Medium

August 27, 2026 Patched in ["4.21.1"] CVE-2026-18234

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation Critical

August 11, 2026 Patched in ["4.21.0"] CVE-2026-27543

MStore API <= 4.20.0 - Missing Authorization Medium

August 3, 2026 Patched in ["4.21.0"] CVE-2026-16041

MStore API <= 4.20.0 - Missing Authorization Medium

August 3, 2026 Patched in ["4.21.0"] CVE-2026-16038

MStore API <= 4.20.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure Medium

August 3, 2026 Patched in ["4.21.0"] CVE-2026-16039

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization Medium

July 7, 2026 Patched in ["4.19.0"] CVE-2026-57375

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization Medium

June 17, 2026 Patched in ["4.19.0"] CVE-2026-54817

MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update Medium

April 8, 2026 Patched in ["4.18.4"] CVE-2026-3568

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation Medium

May 26, 2025 Patched in ["4.17.6"] CVE-2025-4683

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation Medium

May 1, 2025 Patched in ["4.17.5"] CVE-2025-3438

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting) Medium

December 12, 2024 Patched in ["4.16.5"] CVE-2024-12042

MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection Medium

November 19, 2024 Patched in ["4.15.8"] CVE-2024-11179

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload Medium

September 12, 2024 Patched in ["4.15.4"] CVE-2024-8242

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration High

September 12, 2024 Patched in ["4.15.4"] CVE-2024-8269

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover High

August 14, 2024 Patched in ["4.15.3"] CVE-2024-7628

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass Critical

July 11, 2024 Patched in ["4.15.0"] CVE-2024-6328

MStore API <= 4.10.1 - Cross-Site Request Forgery Medium

December 26, 2023 Patched in ["4.10.2"] CVE-2023-50878

MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection High

October 3, 2023 Patched in ["4.0.7"] CVE-2023-45055

MStore API <= 4.0.1 - Unauthenticated SQL Injection Critical

June 23, 2023 Patched in ["4.0.2"] CVE-2023-3197

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation Critical

June 19, 2023 Patched in ["4.10.8"] CVE-2023-3277

MStore API <= 3.9.7 - Unauthenticated SQL Injection Critical

June 19, 2023 Patched in ["3.9.8"] CVE-2022-47614

MStore API <= 3.9.8 - Unauthenticated Privilege Escalation Critical

June 19, 2023 Patched in ["3.9.9"] CVE-2023-3076

MStore API <= 3.9.7 - Unauthenticated SQL Injection Critical

June 19, 2023 Patched in ["3.9.8"] CVE-2023-3077

MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3203

MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3200

MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3199

MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3198

MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3201

MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update Medium

June 13, 2023 Patched in ["3.9.7"] CVE-2023-3202

MStore API <= 3.9.6 - Missing Authorization Medium

June 12, 2023 Patched in ["3.9.7"] CVE-2023-3131

MStore API <= 3.9.2 - Authentication Bypass Critical

May 24, 2023 Patched in ["3.9.3"] CVE-2023-2732

MStore API <= 3.9.1 - Authentication Bypass Critical

May 22, 2023 Patched in ["3.9.2"] CVE-2023-2734

MStore API <= 3.9.0 - Authentication Bypass Critical

May 17, 2023 Patched in ["3.9.1"] CVE-2023-2733

MStore API < 3.4.5 - Arbitrary File Upload Critical

October 5, 2021 Patched in ["3.4.5"]

MStore API <= 3.1.9 - Authentication Bypass Critical

February 2, 2021 Patched in ["3.2.0"] CVE-2021-24148

MStore API <= 2.1.5 - Authentication Bypass Critical

March 11, 2020 Patched in ["2.1.6"] CVE-2020-36713

What It Does

MStore API exposes your WordPress or WooCommerce data through a REST API that pairs with the FluxBuilder app builder, letting you publish native Android and iOS apps driven by your site's existing content and products. In practice, you install this plugin on your store, connect it to the FluxBuilder tool, and assemble a mobile app without writing native code. The actual app compilation and UI work happens inside FluxBuilder, not within WordPress itself.

Who It's For

This plugin suits WooCommerce store owners and small to mid-sized retailers who want a mobile shopping app without hiring a Flutter or native developer, and who are comfortable using a third-party builder (FluxBuilder) alongside WordPress. It works best for shops that already run WooCommerce cleanly and want a quick path to iOS and Android listings.

Who Should Skip It

If you only need a responsive mobile website, a PWA, or already use a fully independent app development workflow, skip this plugin since it adds dependency on an external builder. Sites that do not run WooCommerce or that need deep custom native features (push workflows, complex offline sync, native AR, etc.) will outgrow what MStore API and FluxBuilder provide.

The Bottom Line

MStore API is a competent bridge plugin for WooCommerce stores that want a no-code mobile app through FluxBuilder, and its maintenance and compatibility scores are excellent. The downsides are its limited install base, thin public support history, and reliance on a separate paid builder, so treat it as a starting point rather than a finished solution. With a Quality Score of 74.17/100, it is worth a look for small retailers who specifically want Flutter-based apps, but larger stores with complex needs should pilot carefully.

Pick WP Data Access instead if you need to build data-driven dashboards, tables, and forms from WordPress content rather than a consumer-facing shopping app.

Hippoo Mobile App for WooCommerce 76/100

Choose Hippoo if you want a more WooCommerce-focused mobile app builder with a closer integration to product, cart, and checkout flows.

WappPress – Convert Site to App Fast – WordPress to Mobile App Builder 72/100

Pick WappPress if you only need an Android wrapper around your existing site rather than a full native iOS and Android storefront built on Flutter.