CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3131 – MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
https://notcve.org/view.php?id=CVE-2023-3131
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. The MStore API plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions called via AJAX actions such as mstore_delete_json_file, mstore_update_limit_product, mstore_update_firebase_server_key, mstore_update_new_order_title, mstore_update_new_order_message, mstore_update_status_order_title, and mstore_update_status_order_message in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to perform several unauthorized actions that allow the attacker to control the plugins settings. This was partially patched in 3.9.6 but not fully patched until 3.9.7. CVE-2023-3209 Also applies to this vulnerability. • https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 13%CPEs: 1EXPL: 3CVE-2023-2732 – MStore API <= 3.9.2 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2732
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://github.com/RandomRobbieBF/CVE-2023-2732 https://github.com/ThatNotEasy/CVE-2023-2732 https://github.com/Jenderal92/WP-CVE-2023-2732 https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/listing-rest-api/class.api.fields.php#L1079 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2916124%40mstore-api&old=2915729%40mstore-api&sfp_email=&sfph_mail=#file58 https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3& • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2734 – MStore API <= 3.9.1 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2734
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L911 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2915729%40mstore-api&old=2913397%40mstore-api&sfp_email=&sfph_mail=#file59 https://www.wordfence.com/threat-intel/vulnerabilities/id/5881d16c-84e8-4610-8233-cfa5a94fe3f9?source=cve • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2733 – MStore API <= 3.9.0 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-2733
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. • https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/flutter-woo.php#L734 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2913397%40mstore-api&old=2910707%40mstore-api&sfp_email=&sfph_mail=#file60 https://www.wordfence.com/threat-intel/vulnerabilities/id/c726d8f0-7f2a-414b-9d73-a053921074d9?source=cve • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24148 – MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
https://notcve.org/view.php?id=CVE-2021-24148
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. Un problema de lógica empresarial en el plugin de WordPress MStore API, versiones anteriores a 3.2.0, presentaba una omisión de autenticación con Sign In With Apple que permitía a usuarios no autenticados recuperar una cookie de autenticación con solo una dirección de correo electrónico • https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •