CVE-2023-3277

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada inspireui mstore api. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.

Rincian

Terbit di NVD

3 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L821 product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2988788%40mstore-api%2Ftrunk&...