Paper/Archive/CVE-2025-11127

CVE-2025-11127

Unknown Mstoreapp Mobile App — Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 29.0.290 × 205.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

Affected

ProductAffectedFixed inSource

Mstoreapp Mobile App≤ 2.0.8–CNA

Mstoreapp Mobile Multivendor≤ 9.0.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626