CVE-2023-2732 in MStore API Plugin
Summary
by MITRE • 05/25/2023
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-2732 affects the MStore API plugin for WordPress, representing a critical authentication bypass flaw that undermines the security posture of affected installations. This vulnerability exists within versions up to and including 3.9.2, making a significant portion of WordPress deployments potentially susceptible to exploitation. The flaw specifically manifests in the plugin's handling of add listing REST API requests, where inadequate verification mechanisms allow unauthorized access to user authentication systems. The vulnerability's impact extends beyond simple privilege escalation as it enables attackers to assume the identity of any existing user account on the WordPress site, including high-privilege administrator accounts.
The technical root cause of this vulnerability stems from insufficient input validation and authentication checks within the plugin's REST API endpoint implementation. When processing add listing requests through the MStore API, the plugin fails to properly validate the user context or authentication status of the requester. This weakness creates a direct pathway for attackers to manipulate the authentication flow by supplying specific user identifiers, effectively circumventing the normal authentication mechanisms. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a clear violation of proper access control principles. Attackers exploiting this flaw need only know the user ID of a target account to potentially gain unauthorized access, making the attack surface particularly broad and accessible.
The operational impact of this vulnerability is severe and multifaceted, as it allows unauthenticated attackers to gain administrative access to WordPress sites without requiring valid credentials. This authentication bypass enables attackers to perform any action permitted by the compromised user's role, including but not limited to modifying content, installing malicious plugins, accessing sensitive data, and potentially compromising the entire WordPress installation. The vulnerability's exploitation can lead to complete site takeover, data breaches, and unauthorized modifications to website content. From an attacker's perspective, the ease of exploitation makes this particularly dangerous as it requires minimal prerequisites beyond knowledge of a user ID, which may be easily obtained through various reconnaissance techniques or social engineering approaches. The vulnerability also creates opportunities for attackers to leverage the compromised administrative access for further lateral movement within networks or to establish persistent access through malicious code injection.
Mitigation strategies for CVE-2023-2732 should prioritize immediate plugin updates to versions that address the authentication bypass flaw, as this represents the most direct and effective remediation approach. Organizations should implement comprehensive monitoring of REST API endpoints for unusual access patterns or unauthorized authentication attempts that might indicate exploitation attempts. Network-level security controls including API rate limiting and access control lists can help reduce the effectiveness of automated exploitation attempts. Additionally, implementing strong user account management practices, including regular user ID rotation and privilege reviews, can limit the potential impact of successful exploitation. Security teams should also consider implementing web application firewalls with rules specifically designed to detect and block suspicious REST API requests that attempt to manipulate authentication parameters. From a defense-in-depth perspective, organizations should conduct thorough security assessments of all installed WordPress plugins and ensure that proper authentication and authorization mechanisms are implemented across all API endpoints, aligning with ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting.