Authentication Bypass in MStore API Plugin for WordPress

CVE-2023-2733

Summary

The MStore API plugin for WordPress is affected by an authentication bypass vulnerability that allows unauthenticated attackers to gain access to user accounts, including administrator accounts. This flaw stems from a lack of adequate user verification during the coupon redemption REST API requests. Attackers can exploit this vulnerability to log in as any existing user by merely knowing the user ID, putting sensitive information at risk and threatening the overall security of the affected WordPress sites.

References