CVE-2023-2734
Assigner: Wordfence
Published: 2023-05-25T02:05:31.657Z
State: PUBLISHED
affected: vendor: inspireui
product: MStore API
versions: version: *
status: affected
lessThanOrEqual: 3.9.1
versionType: semver
defaultStatus: unaffected
descriptions: value: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
problemTypes: descriptions: description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
credits: type: finder
value: Lana Codes
timeline: time: 2023-05-16T00:00:00.000+00:00
value: Discovered
time: 2023-05-16T00:00:00.000+00:00
value: Vendor Notified
time: 2023-05-22T00:00:00.000+00:00
value: Disclosed