Lucene search

WordfenceCVE-2024-8269

HistorySep 13, 2024 - 3:15 p.m.

CVE-2024-8269

2024-09-1315:15:17

CWE-284

Wordfence

web.nvd.nist.gov

mstore api

wordpress

unauthorized user registration

user account

plugin vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

inspireuimstore_apiRange<4.15.4wordpress

VendorProductVersionCPE
inspireuimstore_api*cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
inspireui	mstore_api	*	cpe:2.3:a:inspireui:mstore_api::::::wordpress::*

CNA Affected

[
  {
    "vendor": "inspireui",
    "product": "MStore API – Create Native Android & iOS Apps On The Cloud",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "4.15.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L406

plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L454

plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/controllers/flutter-user.php

www.wordfence.com/threat-intel/vulnerabilities/id/59c5b6e7-74b0-430d-8b4a-5a42220f3ec9?source=cve

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

Related for CVE-2024-8269