MStore API < 3.9.8 - Unauthenticated Blind SQLi

CVE-2023-3077

What is CVE-2023-3077?

The MStore API plugin for WordPress, prior to version 3.9.8, is susceptible to a Blind SQL Injection due to inadequate sanitization and escaping of a particular parameter within its SQL queries. This vulnerability can be exploited by unauthenticated users, particularly if the site owner opts to enable the pro features of the plugin and utilizes the WooCommerce Appointments plugin. Attackers can execute database queries, potentially resulting in unauthorized data access or manipulation.

References