Unauthorized User Registration Vulnerability in MStore API Plugin

CVE-2024-8269

Summary

The MStore API Plugin, used for creating native Android and iOS applications on the WordPress platform, is vulnerable to unauthorized user registration across all versions up to and including 4.15.3. This vulnerability arises from the lack of validation when registering users through the register() function. Attackers can exploit this flaw to create user accounts on WordPress sites, undermining the user registration settings intended to restrict such actions. The vulnerability poses significant risks, particularly for sites where user registration should be disabled. Site administrators are advised to assess their use of the MStore API Plugin and consider applying necessary patches or updates to safeguard their environments.

References