CVE-2023-3199
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This allows unauthenticated attackers to update status order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to change order status titles, potentially leading to misinformation or fraud within the ordering system. This poses a risk of losing customer trust and potential financial losses.
Recommendation
It is recommended to implement nonce validation in the mstore_update_status_order_title function and to regularly update WordPress plugins to minimize the risk of attacks. Additionally, administrators should be cautious when clicking on links in emails or on websites.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.