CVE-2023-3131 MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
Attackers can modify plugin settings without authorization due to missing privilege and nonce checks in AJAX actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3131?
CVE-2023-3131 is a medium-severity missing authorization vulnerability in Unknown MStore API, published on 10 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Which versions are affected by CVE-2023-3131?
It affects 1 product.
Products include Inspireui Mstore Api.
How do I fix CVE-2023-3131?
No fix has been published for CVE-2023-3131 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3131 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3131 exists.
Other vulnerabilities in Unknown MStore API
- CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass
- CVE-2023-3277 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
- CVE-2023-3076 MStore API < 3.9.9 - Unauthenticated Privilege Escalation
- CVE-2023-3077 MStore API < 3.9.8 - Unauthenticated Blind SQLi
- CVE-2023-3197 MStore API <= 4.0.1 - Unauthenticated SQL Injection
Sources
Also known as GHSA-7x52-4x54-c7jw.