CVE-2023-3277criticalobserved exploitationCWE-288

CVE-2023-3277: critical vulnerability in inspireui MStore API – Create Native Android &…

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

Published · Updated

Follow this CVE+ Monitor MStore API – Create Native Android & iOS Apps On The Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Patch now. It exploitation observed in the wild and has a working public exploit.

ssvc Actcvss 9.8epss 3.4%
from disclosure to weapon
Published on NVDNov 3
Observed exploitationJun 19
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
inspireui · MStore API – Create Native Android & iOS Apps On The Cloud
Related CVEs — inspireui MStore API – Create Native Android &…

In the same product, most dangerous first.

CVE-2023-2732CRITICALMStore API <= 3.9.2 - Authentication BypassEPSS 67.3%CVE-2023-3197CRITICALMStore API <= 4.0.1 - Unauthenticated SQL InjectionEPSS 3.9%CVE-2023-2734CRITICALMStore API <= 3.9.1 - Authentication BypassEPSS 3.8%CVE-2020-36713CRITICALMStore API <= 2.1.5 - Authentication BypassEPSS 1.6%CVE-2023-2733CRITICALMStore API <= 3.9.0 - Authentication BypassEPSS 1.2%CVE-2024-8242MEDIUMMStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.8%