cbcvebase.
CVE-2023-2734
published 2023-05-25

CVE-2023-2734: The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on…

PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.81%
88.7th percentile
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.

Affected

2 ranges
VendorProductVersion rangeFixed in
inspireuimstore_api<= 3.9.1—
inspireuimstore_api_create_native_android_ios_apps_on_the_cloud<= 3.9.1—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-json/api/flutter_woo/cart↗
path/wp-content/plugins/mstore-api/↗
url/wp-json/wp/v2/users↗
url?rest_route=/wp/v2/users↗
other{"customer_id":{{user_id}}}↗
  • →Detect exploitation attempts by monitoring POST requests to /wp-json/api/flutter_woo/cart with a JSON body containing 'customer_id'. A successful exploit will set a 'wordpress_logged_in_' cookie in the response header. ↗
  • →Reconnaissance phase: attackers first enumerate user IDs via the WordPress REST API users endpoint before attempting the cart sync authentication bypass. Monitor for unauthenticated GET requests to /wp-json/wp/v2/users or ?rest_route=/wp/v2/users followed by POST to /wp-json/api/flutter_woo/cart. ↗
  • →Confirm successful authentication bypass by checking if the response to /wp-admin/index.php (after the cart sync) contains 'Dashboard', 'Plugins', and 'Edit Profile' — indicating admin-level access was granted. ↗
  • →Identify vulnerable WordPress installations by searching for the MStore API plugin path in page bodies or HTTP responses. ↗
  • ·The vulnerability affects MStore API versions up to and including 3.9.1. The fix is present in version 3.9.2 and later. Detections should be scoped to sites running the vulnerable version range. ↗
  • ·The attack requires the attacker to already know or enumerate a valid user ID. The REST API user enumeration endpoint (/wp-json/wp/v2/users) is a prerequisite step in the attack chain and may be blocked independently as a mitigation. ↗
  • ·The Nuclei template uses a 3-step flow (user enumeration → cart sync POST → admin panel access check). A detection rule should account for all three steps in sequence to reduce false positives. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.