CVE-2023-3200
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This allows unauthenticated attackers to update new order messages via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to manipulate order messages, potentially leading to loss of customer trust and financial losses for the organization.
Recommendation
It is recommended to implement nonce validation in the mstore_update_new_order_message function and to regularly update WordPress plugins to minimize risk.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.