CVE-2023-3076 MStore API < 3.9.9 - Unauthenticated Privilege Escalation
Unauthenticated attackers can create user accounts with arbitrary roles via the wholesale REST API endpoint in the MStore API WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3076?
CVE-2023-3076 is a critical vulnerability in Unknown MStore API, published on 10 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Weakness: CWE-862
Which versions are affected by CVE-2023-3076?
It affects 1 product.
Products include Inspireui Mstore Api.
How do I fix CVE-2023-3076?
No fix has been published for CVE-2023-3076 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-3076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3076 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown MStore API
- CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass
- CVE-2023-3277 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
- CVE-2023-3077 MStore API < 3.9.8 - Unauthenticated Blind SQLi
- CVE-2023-3197 MStore API <= 4.0.1 - Unauthenticated SQL Injection
- CVE-2020-36713 MStore API <= 2.1.5 - Authentication Bypass
Sources
Also known as GHSA-gwr5-qqvh-c57m.