VULNERABILITY INTELLIGENCE

CVE-2023-3076

CVSS score9.8 CRITICAL
EPSS probability2.17%
CISA KEVNot currently listed
Published2023-07-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.

Weakness classification

  • nvd@nist.gov: CWE-862

Primary references