CVE-2023-3202
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This allows unauthenticated attackers to update the Firebase server key for push notifications when the order status changes, provided they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to take control of push notifications, potentially leading to misinformation or fraud related to orders. This poses a serious risk to data integrity and user trust.
Recommendation
It is recommended to implement nonce validation in the mstore_update_firebase_server_key function and to regularly update WordPress plugins to minimize the risk of CSRF attacks.
Other vulnerabilities in MStore API plugin for WordPress
See all- CVE-2023-3197Critical
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to and including 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query.
- CVE-2023-3199Medium
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This allows unauthenticated attackers to update status order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
- CVE-2023-3203Medium
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This allows unauthenticated attackers to update the limit of products per category via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
- CVE-2023-3201Medium
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This allows unauthenticated attackers to update new order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
- CVE-2023-3200Medium
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This allows unauthenticated attackers to update new order messages via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
- CVE-2023-3198Medium
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This allows unauthenticated attackers to update status order messages via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.