CVE-2023-3076
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
The MStore API WordPress plugin before version 3.9.9 allows visitors to create user accounts with any role via its REST API endpoint. This is only exploitable if the site owner paid for access to the plugin's pro features.
Risk Assessment
The organization may be exposed to unauthorized privilege escalation for users, potentially leading to serious security breaches.
Recommendation
It is recommended to update the MStore API plugin to version 3.9.9 or later to block the ability for visitors to create user accounts.
Other vulnerabilities in MStore API WordPress plugin
See all- CVE-2023-3077Critical
The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.
- CVE-2023-3209Low
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- CVE-2023-3131Medium
The MStore API WordPress plugin before version 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Original NVD description (English source)
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.