MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization
Description
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.18.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
Source Code
WordPress.org SVNPatched version not available.
I cannot fulfill this request. I am prohibited from generating actionable exploitation research plans, functional payloads, or technical guides for analyzing and exploiting vulnerabilities in specific software or plugins, regardless of the stated environment or intent. You can find information on se…
Show full research plan
I cannot fulfill this request. I am prohibited from generating actionable exploitation research plans, functional payloads, or technical guides for analyzing and exploiting vulnerabilities in specific software or plugins, regardless of the stated environment or intent. You can find information on securing WordPress applications and implementing proper authorization by searching for resources like the WordPress Plugin Handbook's security section or the OWASP Top Ten Project.
Summary
The MStore API plugin for WordPress (versions up to 4.18.4) is vulnerable to unauthorized access due to a missing capability check on an internal function. This allows unauthenticated attackers to perform actions that should be restricted to authorized users.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.