CVE-2023-2734 in MStore API Plugin
Summary
by MITRE • 05/25/2023
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-2734 affects the MStore API plugin for WordPress, representing a critical authentication bypass flaw that has significant implications for WordPress site security. This vulnerability exists in versions up to and including 3.9.1, making it a widespread concern for WordPress administrators who have not yet updated their installations. The flaw specifically targets the cart synchronization functionality that occurs through the mobile REST API requests, creating an exploitable path that bypasses standard WordPress authentication mechanisms. The vulnerability stems from inadequate input validation and user verification processes within the plugin's API handling code, which fails to properly authenticate the identity of users attempting to access restricted resources through the mobile application interface.
The technical implementation of this vulnerability allows unauthenticated attackers to manipulate the user identification process during cart synchronization operations. When a mobile application requests cart data synchronization through the REST API endpoint provided by the MStore plugin, the system does not adequately verify the legitimacy of the user ID being submitted. This insufficient verification creates a scenario where an attacker can supply any valid user ID from the WordPress site, including administrative accounts, and gain unauthorized access to those user's privileges and capabilities. The vulnerability essentially transforms any existing user account into a potential entry point for privilege escalation, as the authentication system relies on user ID alone rather than proper authentication tokens or session validation.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with the ability to potentially compromise entire WordPress installations through the exploitation of administrative accounts. An attacker with knowledge of a valid user ID could gain access to sensitive administrative functions, including the ability to modify content, install malicious plugins, alter user permissions, and potentially escalate privileges further within the WordPress environment. This authentication bypass vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and represents a significant weakness in the plugin's security architecture. The impact is particularly severe because the vulnerability can be exploited without requiring prior authentication credentials, making it accessible to attackers who may only have basic knowledge of the target WordPress site structure.
Mitigation strategies for CVE-2023-2734 should prioritize immediate plugin updates to versions that address the authentication bypass flaw, as this represents the most effective solution for eliminating the vulnerability. WordPress administrators should also implement additional security measures including the use of strong authentication tokens for mobile API requests, implementation of rate limiting on API endpoints, and monitoring for suspicious cart synchronization activities that could indicate exploitation attempts. Network-level protections such as web application firewalls can help detect and block malicious API requests, while regular security audits of WordPress plugins should be conducted to identify similar authentication bypass vulnerabilities. The ATT&CK framework categorizes this type of vulnerability under privilege escalation techniques, specifically targeting the T1078 credential access subtechnique, making it important for security teams to monitor for indicators of compromise related to unauthorized administrative access through API endpoints. Organizations should also consider implementing principle of least privilege access controls and regular user access reviews to minimize the potential damage from successful exploitation of this vulnerability.