VulnerabilityModified
CVE-2023-3076
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint.
CRITICAL 9.8EPSS 2.17%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.17% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- inspireui/mstore api
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5bExploit, Third Party Advisory
- https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5bExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.