CVE-2023-3076
MStore API < 3.9.9 - Unauthenticated Privilege Escalation
- State
- Published
- Severity
- Not scored
- Published
- Jul 10, 2023
- Updated
- Nov 12, 2024
- Reserved
- Jun 2, 2023
Description
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
MStore APIUnknown |
|
References
- https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5bexploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.