CVE-2023-2732criticalobserved exploitationCWE-288

CVE-2023-2732: critical vulnerability in inspireui MStore API – Create Native Android &…

MStore API <= 3.9.2 - Authentication Bypass

Published · Updated

Follow this CVE+ Monitor MStore API – Create Native Android & iOS Apps On The Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Patch now. It exploitation observed in the wild and has a working public exploit.

ssvc Actcvss 9.8epss 67%
from disclosure to weaponsame day
Published on NVDMay 25
1st PoCMay 25
Observed exploitation+347d
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
inspireui · MStore API – Create Native Android & iOS Apps On The Cloud
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — inspireui MStore API – Create Native Android &…

In the same product, most dangerous first.

CVE-2023-3197CRITICALMStore API <= 4.0.1 - Unauthenticated SQL InjectionEPSS 3.9%CVE-2023-2734CRITICALMStore API <= 3.9.1 - Authentication BypassEPSS 3.8%CVE-2023-3277CRITICALMStore API <= 4.10.7 - Unauthorized Account Access and Privilege EscalationEPSS 3.4%CVE-2020-36713CRITICALMStore API <= 2.1.5 - Authentication BypassEPSS 1.6%CVE-2023-2733CRITICALMStore API <= 3.9.0 - Authentication BypassEPSS 1.2%CVE-2024-8242MEDIUMMStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.8%