CVE-2023-3077
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.
Risk Assessment
The organization may be exposed to unauthorized access to database information, potentially leading to data leaks or manipulation. If exploited, attackers could gain access to sensitive information.
Recommendation
It is recommended to update the MStore API plugin to version 3.9.8 or later to eliminate this vulnerability. Additionally, conducting a security audit of the plugins used on the site is advisable.
Original NVD description (English source)
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.