VULNERABILITY INTELLIGENCE

CVE-2025-11127

CVSS score9.8 CRITICAL

EPSS probability0.35%

CISA KEVNot currently listed

Published2025-11-21

Last modified2026-10-19

Description

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.