28 matches found
CVE-2023-3077
CVE-2023-3077 affects the MStore API WordPress plugin prior to version 3.9.8. The vulnerability is a Blind SQL injection in which the product_id parameter is not sanitized/escaped before being used in a SQL statement, and it is exploitable by unauthenticated users. Public details indicate exploit...
CVE-2023-3076
CVE-2023-3076 affects the MStore API WordPress plugin (pre-3.9.9). The wholesale REST API endpoint allows unauthenticated visitors to create user accounts with a role of their choice, enabling privilege escalation, and this attack is conditioned on the site owner purchasing pro features. The NVD/...
CVE-2023-3131
CVE-2023-3131 affects the MStore API WordPress plugin prior to version 3.9.7. The vulnerability arises because most AJAX actions are not protected by privilege checks or nonce validation, enabling unauthorized actions such as modifying settings. Public references describe practical proof-of-conce...
CVE-2023-3209
CVE-2023-3209 affects the MStore API WordPress plugin prior to version 3.9.7, where many AJAX actions lack proper privilege checks and nonce validation, enabling unauthorized changes to settings (CSRF). Multiple sources corroborate an upstream issue that allows privilege escalation via crafted re...
CVE-2023-2732
CVE-2023-2732 affects the MStore API plugin for WordPress up to version 3.9.2. The root cause is insufficient verification of the user parameter supplied during the add listing REST API request, enabling an unauthenticated attacker to log in as any existing user on the site (e.g., an administrato...
CVE-2024-6328
CVE-2024-6328 – MStore API (WordPress plugin) authentication bypass . The WordPress plugin MStore API – Create Native Android & iOS Apps On The Cloud is vulnerable in all versions up to 4.14.7 due to insufficient verification on the phone parameter in firebase_sms_login and firebase_sms_login_v2,...
CVE-2023-3277
CVE-2023-3277 affects the WordPress MStore API plugin (versions
CVE-2024-11179
CVE-2024-11179 concerns the WordPress plugin MStore API – Create Native Android & iOS Apps On The Cloud . Public sources confirm an SQL Injection vulnerability via the vulnerable parameter status_type in all versions up to and including 4.15.7, caused by insufficient escaping and improper query p...
CVE-2024-7628
CVE-2024-7628 involves the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin. It allows authentication bypass via a loose token-id verification in verify_id_token, enabling unauthenticated login as an existing site user (potentially an administrator) if firebase is confi...
CVE-2024-12042
CVE-2024-12042 is an authenticated Stored Cross-Site Scripting vulnerability in the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin (
CVE-2024-8242
CVE-2024-8242 : The WordPress MStore API plugin (
CVE-2023-50878
CVE-2023-50878 concerns a CSRF vulnerability in InspireUI MStore API. The connected Red Hat entry confirms a Cross-Site Request Forgery affecting the MStore API up to version 4.10.1. The initial and connected documents do not provide technical details about the root cause beyond CSRF, affected co...
CVE-2025-4683
CVE-2025-4683 affects the WordPress plugin “MStore API – Create Native Android & iOS Apps On The Cloud” up to and including version 4.17.5. The root cause is a missing capability check in the create_blog function, enabling authenticated attackers with Subscriber-level access and above to create n...
CVE-2024-8269
CVE-2024-8269 – MStore API (WordPress) is an unauthenticated vulnerability in the MStore API plugin (WordPress) affecting versions up to 4.15.3. The issue arises because register() does not verify that user registration is enabled, allowing unauthenticated attackers to create user accounts on sit...
CVE-2023-2734
CVE-2023-2734 affects the MStore API plugin for WordPress (versions up to and including 3.9.1). The root cause is insufficient verification of the user during the cart sync via the plugin’s mobile REST API, enabling authentication bypass that can let unauthenticated attackers log in as any existi...
CVE-2023-2733
CVE-2023-2733 concerns the WordPress plugin MStore API . The vulnerability is an authentication bypass in versions up to and including 3.9.0 caused by insufficient verification of the user parameter supplied during the coupon redemption REST API call, enabling unauthenticated attackers to log in ...
CVE-2025-3438
The CVE-2025-3438 entry concerns the WordPress MStore API plugin (≤ 4.17.4), which allows unauthenticated privilege escalation by registering as the wcfm_vendor Store Vendor role due to insufficient role restrictions during registration. Exploitation requires the WCFM Marketplace – Multivendor Ma...
CVE-2023-3197
The CVE-2023-3197 entry concerns the WordPress MStore API plugin (
CVE-2021-24148
CVE-2021-24148 affects the WordPress plugin MStore API (vulnerable:
CVE-2022-47614
CVE-2022-47614 : Unauth. SQL Injection in the InspireUI MStore API WordPress plugin, affected versions
CVE-2023-3202
CVE-2023-3202: The MStore API WordPress plugin is vulnerable to CSRF due to missing nonce validation on mstore_update_firebase_server_key, enabling unauthenticated attackers to alter the Firebase server key and push notifications when an order status changes via forged requests. Impact is limited...
CVE-2023-3199
CVE-2023-3199 affects the MStore API WordPress plugin. The vulnerability is a CSRF due to missing nonce validation in mstore_update_status_order_title, enabling unauthenticated attackers to forge requests to update status order titles if a site admin is tricked into actions. Publicly documented d...
CVE-2023-3198
The CVE-2023-3198 entry refers to the MStore API WordPress plugin (
CVE-2020-36713
The CVE-2020-36713 issue affects the WordPress MStore API plugin up to version 2.1.5, where unrestricted access to the register and update_user_profile routes enables authentication bypass. This allows unauthenticated attackers to create or delete administrator accounts or escalate privileges. Re...
CVE-2023-3203
CVE-2023-3203 affects the WordPress plugin MStore API (versions
CVE-2023-3201
CVE-2023-3201 – MStore API (WordPress) : CSRF due to missing nonce validation in mstore_update_new_order_title. Unauthenticated attackers can forge requests to update new order titles by tricking an admin. Affected versions: