CVE-2023-3131
MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
10 Jul 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Affected products
Unknown · MStore API