Authentication Bypass Vulnerability in MStore API Plugin for WordPress
CVE-2024-7628

8.1HIGH

Key Information:

Vendor
Wordpress
Status
Mstore Api – Create Native Android & iOS Apps On The Cloud
Vendor
CVE Published:
15 August 2024

Summary

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress has a vulnerability that allows for authentication bypass due to improper type comparison in the 'verify_id_token' function. This flaw allows unauthorized users to gain access to any existing account on the site, including administrative accounts, when they have access to an @flutter.io email address or phone number. Proper configuration of Firebase for the website is required for exploitation, along with user account setup on Firebase.

Affected Version(s)

MStore API – Create Native Android & iOS Apps On The Cloud * <= 4.15.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://plugins.trac.wordpress.org/browser/mstore-api/tru...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Truoc Phan
.