Paper/Archive/CVE-2023-3277

CVE-2023-3277

inspireui MStore API – Create Native Android & iOS Apps On The Cloud — MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 86.9.869 × 2017.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.

Affected

ProductAffectedFixed inSource

MStore API – Create Native Android & iOS Apps On The Cloud≤ 4.10.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=cve refplugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L821 refplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2988788%40mstore-api%2Ftrunk&old=2985882%40mstore-api%2Ftrunk&sfp_email=&sfph_mail=