WordPress Plugin Vulnerabilities

MStore API < 4.10.8 - Unauthenticated Privilege Escalation

Description

The plugin does not implement the Apple login feature correctly, which could lead to unauthorized account access and privilege escalation if the attacker knows the user's email address.

Affects Plugins

Plugin icon
mstore-api
Fixed in 4.10.8

References

CVE
CVE-2023-3277
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854

Miscellaneous

Original Researcher
Truoc Phan, An Đặng
Verified
No
WPVDB ID
3b3049ee-b077-4c0b-bbc5-ea441c834881

Timeline

Publicly Published
2023-06-19 (about 2 years ago)
Added
2023-11-03 (about 2 years ago)
Last Updated
2023-11-08 (about 2 years ago)

Other

Published
Title
Published
2025-08-15
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.1 - Directory Traversal
Published
2023-05-30
Title
Blog-in-Blog <= 1.1.1 - Editor+ Stored Cross-Site Scripting via Shortcode
Published
2023-05-27
Title
WP EasyCart < 5.4.9 - Product Deletion via CSRF
Published
2023-09-25
Title
Simple Membership < 4.3.5 - Privilege escalation via Registration
Published
2023-11-24
Title
Captcha Code < 3.0 - Captcha Bypass