CVE-2021-24148: fallo en MStore API
MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 3.4%
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Productos afectados
Unknown · MStore APICVEs relacionadas — MStore API
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-3077—MStore API < 3.9.8 - Unauthenticated Blind SQLiEPSS 5.5%CVE-2023-3076—MStore API < 3.9.9 - Unauthenticated Privilege EscalationEPSS 2.2%CVE-2023-3131—MStore API < 3.9.7 - Subscriber+ Unauthorized Settings UpdateEPSS 0.6%CVE-2026-16038CRITICALMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysEPSS 0.4%CVE-2026-16030HIGHMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone AuthenticationEPSS 0.4%CVE-2026-16041HIGHMStore API < 4.21.0 - Unauthenticated Product Review CreationEPSS 0.4%