CVE-2020-36713

🗓️ 07 Jun 2023 01:51:32Reported by WordfenceType

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Unrestricted access to 'register' and 'update_user_profile' routes allows unauthenticated attackers to create new admin accounts, delete existing ones, or escalate privileges

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress Plugin MStore API 访问控制错误漏洞	7 Jun 202300:00	–	cnnvd
Cvelist	CVE-2020-36713 MStore API <= 2.1.5 - Authentication Bypass	7 Jun 202301:51	–	cvelist
EUVD	EUVD-2020-24155	7 Oct 202500:30	–	euvd
NVD	CVE-2020-36713	7 Jun 202302:15	–	nvd
OSV	CVE-2020-36713	7 Jun 202302:15	–	osv
Prion	Authentication flaw	7 Jun 202302:15	–	prion
Positive Technologies	PT-2023-11855 · WordPress · Mstore Api	7 Jun 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2020-36713: Authentication Bypass Using an Alternate Path or Channel	7 Jun 202300:00	–	rapid7
RedhatCVE	CVE-2020-36713	5 Feb 202515:07	–	redhatcve
Vulnrichment	CVE-2020-36713 MStore API <= 2.1.5 - Authentication Bypass	7 Jun 202301:51	–	vulnrichment

NVD

Vulners

Node

inspireui mstore_apiRange≤2.1.5wordpress

[
  {
    "vendor": "inspireui",
    "product": "MStore API – Create Native Android & iOS Apps On The Cloud",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2.1.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
blog	www.blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d
acunetix	www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/

17 Jun 2026 03:16Current

9.6Critical risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.01605

SSVC