PT-2023-23568 · WordPress · Mstore Api

Truoc Phan · Published 2023-07-12 · Updated 2023-07-19 · CVE-2023-3202

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress (affected versions not specified)

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update firebase server key function. This allows unauthenticated attackers to update the firebase server key for push notifications when the order status changes via a forged request, provided they can trick a site administrator into performing an action like clicking on a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-3202

Affected Products

Mstore Api

References · 7

• https://osv.dev/vulnerability/CVE-2023-3202 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-3202 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail= · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve · Note
• https://t.me/cibsecurity/66514 · Telegram Post
• https://t.me/cvenotify/54662 · Telegram Post