CVE-2023-3277
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
- State
- Published
- Severity
- 9.8 Critical
- Published
- Nov 3, 2023
- Updated
- Apr 8, 2026
- Reserved
- Jun 15, 2023
Description
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Wordfence |
Weaknesses
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected Products
| Product | Versions |
|---|---|
MStore API – Create Native Android & iOS Apps On The Cloudinspireui |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=cve
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L821
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2988788%40mstore-api%2Ftrunk&old=2985882%40mstore-api%2Ftrunk&sfp_email=&sfph_mail=
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.