CVE-2023-2732
published 2023-05-25CVE-2023-2732: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
67.51%
99.2th percentile
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inspireui | mstore_api | <= 3.9.2 | — |
| inspireui | mstore_api_create_native_android_ios_apps_on_the_cloud | <= 3.9.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Probe for authentication bypass by issuing an unauthenticated GET to /wp-json/wp/v2/add-listing?id=1 and then checking /wp-admin/profile.php for a successful session; a 200 response containing both 'email-description' and 'Username' in the profile page body confirms exploitation. ↗
- →Detect presence of the vulnerable plugin on a target by searching HTTP response bodies for the path /wp-content/plugins/mstore-api/ (usable in Shodan, FOFA, or passive recon). ↗
- →The vulnerability is triggered via the 'add listing' REST API endpoint; monitor web server logs for unauthenticated GET requests to /wp-json/wp/v2/add-listing with a numeric 'id' parameter (e.g., id=1) followed immediately by requests to /wp-admin/ paths from the same source IP. ↗
- ·The authentication bypass only affects MStore API versions up to and including 3.9.2; version 3.9.3 and above are patched. Detections targeting this CVE should scope to sites running the vulnerable version range. ↗
- ·Exploitation requires the attacker to know or enumerate a valid WordPress user ID (e.g., id=1 for the default admin). Detections should consider sequential or low-value numeric id parameter probing as a precursor indicator. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q639-qhhx-5j5j: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3
ghsa_unreviewed·2023-05-25
CVE-2023-2732 [CRITICAL] CWE-288 GHSA-q639-qhhx-5j5j: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
VulnCheck
MStore API plugin for WordPress Add Listing REST API Authentication Bypass
vulncheck·2023·CVSS 9.8
CVE-2023-2732 [CRITICAL] MStore API plugin for WordPress Add Listing REST API Authentication Bypass
MStore API plugin for WordPress Add Listing REST API Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Affected: inspireui mstore_api
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf
E
No detection rules found.
Nuclei
MStore API <= 3.9.2 - Authentication Bypass
nuclei·CVSS 9.8
CVE-2023-2732 [CRITICAL] MStore API <= 3.9.2 - Authentication Bypass
MStore API <= 3.9.2 - Authentication Bypass
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Template:
id: CVE-2023-2732
info:
name: MStore API <= 3.9.2 - Authentication Bypass
author: DhiyaneshDK
severity: critical
description: |
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/listing-rest-api/class.api.fields.php#L1079https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2916124%40mstore-api&old=2915729%40mstore-api&sfp_email=&sfph_mail=#file58https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3-b3e3-a471e05815c1?source=cvehttps://plugins.trac.wordpress.org/browser/mstore-api/tags/3.9.0/controllers/listing-rest-api/class.api.fields.php#L1079https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2916124%40mstore-api&old=2915729%40mstore-api&sfp_email=&sfph_mail=#file58https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3-b3e3-a471e05815c1?source=cve
2023-05-25
Published
Exploited in the wild