CRITICAL
MStore API <= 2.1.5 - Authentication Bypass
Published Jun 7, 2023
9.8
CRITICALCVSS 3.1
EPSS 1.60%
Description
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
Affected products
- Vendor Inspireui Product MStore API – Create Native Android & iOS Apps On The Cloud Defaultunaffected
- Version 0StatusaffectedConstraints<2.1.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Inspireui | MStore API – Create Native Android & iOS Apps On The Cloud | unaffected |
|
- ≤ 2.1.5
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (3)
- https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/ Exploit
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/ Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cve Third Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Jun 7, 2023
Updated Apr 8, 2026
Reserved Jun 6, 2023
Link CVE-2020-36713
CISA Vulnrichment
Updated Dec 26, 2024