CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3198 – MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update
https://notcve.org/view.php?id=CVE-2023-3198
13 Jun 2023 — The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L264 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3200 – MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update
https://notcve.org/view.php?id=CVE-2023-3200
13 Jun 2023 — The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L248 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3201 – MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
https://notcve.org/view.php?id=CVE-2023-3201
13 Jun 2023 — The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L240 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3203 – MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
https://notcve.org/view.php?id=CVE-2023-3203
13 Jun 2023 — The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L222 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3131 – MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
https://notcve.org/view.php?id=CVE-2023-3131
12 Jun 2023 — The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. The MStore API plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions called via AJAX actions such as mstore_delete_json_file, mstore_update_limit_product, mstore_update_firebase_server_key, mstore_update_new_order_title, mstore_update_new_order_message, mstore_update_status_order... • https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 16%CPEs: 1EXPL: 3CVE-2023-2732 – MStore API <= 3.9.2 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2732
24 May 2023 — The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://github.com/RandomRobbieBF/CVE-2023-2732 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2734 – MStore API <= 3.9.1 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2734
22 May 2023 — The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L911 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2733 – MStore API <= 3.9.0 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2733
17 May 2023 — The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L734 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24148 – MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
https://notcve.org/view.php?id=CVE-2021-24148
02 Feb 2021 — A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. Un problema de lógica empresarial en el plugin de WordPress MStore API, versiones anteriores a 3.2.0, presentaba una omisión de autenticación con Sign In With Apple que permitía a usuarios no autenticados recuperar una cookie de autenticación con solo una dirección de correo electr... • https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36713 – MStore API <= 2.1.5 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2020-36713
11 Mar 2020 — The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account. • https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •