CVE-2023-3077: vulnerability in MStore API
MStore API < 3.9.8 - Unauthenticated Blind SQLi
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 5.5%
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Affected products
Unknown · MStore APIRelated CVEs — MStore API
In the same product, most dangerous first.
CVE-2021-24148—MStore API < 3.2.0 - Authentication Bypass With Sign In With AppleEPSS 3.4%CVE-2023-3076—MStore API < 3.9.9 - Unauthenticated Privilege EscalationEPSS 2.2%CVE-2023-3131—MStore API < 3.9.7 - Subscriber+ Unauthorized Settings UpdateEPSS 0.6%CVE-2026-16038CRITICALMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysEPSS 0.4%CVE-2026-16030HIGHMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone AuthenticationEPSS 0.4%CVE-2026-16041HIGHMStore API < 4.21.0 - Unauthenticated Product Review CreationEPSS 0.4%