PT-2023-23569 · WordPress · Mstore Api

Truoc Phan · Published 2023-06-14 · Updated 2023-06-20 · CVE-2023-3203

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress (affected versions not specified)

Description The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore update limit product function. This makes it possible for unauthenticated attackers to update the limit of the number of products per category to use cache data in the home screen via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-3203

Affected Products

Mstore Api

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3203 · Security Note
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L222 · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2023-3203 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87?source=cve · Note
• https://t.me/cvenotify/52746 · Telegram Post
• https://t.me/cibsecurity/65224 · Telegram Post