CVE-2023-3202
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This allows unauthenticated attackers to update the Firebase server key for push notifications when the order status changes, provided they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to take control of push notifications, potentially leading to misinformation or fraud related to orders. This poses a serious risk to data integrity and user trust.
Recommendation
It is recommended to implement nonce validation in the mstore_update_firebase_server_key function and to regularly update WordPress plugins to minimize the risk of CSRF attacks.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.