CVE-2023-3203
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This allows unauthenticated attackers to update the limit of products per category via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
Attackers can exploit this vulnerability to manipulate data on the site, potentially leading to unauthorized changes in product configuration. This poses a risk of losing user trust and potential financial losses.
Recommendation
It is recommended to implement nonce validation in the mstore_update_limit_product function and regularly update WordPress plugins to minimize the risk of attacks. Additionally, administrators should be cautious when clicking on links from unknown sources.
Original NVD description (English source)
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.