Authentication Bypass in MStore API Plugin for WordPress
CVE-2023-2734
9.8CRITICAL
Summary
The MStore API plugin for WordPress is susceptible to an authentication bypass vulnerability due to inadequate user verification during cart sync operations via mobile REST API requests. This flaw allows unauthenticated attackers to potentially gain access to the system as existing users, including administrators, by exploiting their user IDs. Users should evaluate their installations and apply necessary security measures to mitigate this risk.
Affected Version(s)
MStore API * <= 3.9.1
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Lana Codes