CVE-2023-3277 is a critical unauthorized account access and privilege escalation vulnerability affecting the MStore API plugin for WordPress, versions up to and including 4.10.7. This flaw stems from improper implementation of the Apple login feature, allowing unauthenticated attackers to log in as any user if their email address is known. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, leading to high impacts on confidentiality, integrity, and availability. While not yet in CISA's KEV catalog, Nuclei templates for exploitation exist, and the vulnerability has garnered significant community discussion and media coverage, indicating a high potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.10.7CPE matchmatch criteria | cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.