VULNERABILITY INTELLIGENCE

CVE-2021-24148

CVSS score9.8 CRITICAL
EPSS probability3.37%
CISA KEVNot currently listed
Published2021-03-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Weakness classification

  • contact@wpscan.com: CWE-287
  • nvd@nist.gov: CWE-287

Primary references