CVE-2023-3203: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product...
4.3
CVSS
Description
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Classification
CVE ID: CVE-2023-3203
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: inspireui
Product: MStore API
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.11% (probability of being exploited)
EPSS Percentile: 44.48% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87?source=cvehttps://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L222
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=