CVE-2023-3200 in MStore API Plugin
Summary
by MITRE • 06/14/2023
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-3200 affects the MStore API plugin for WordPress, presenting a critical cross-site request forgery weakness that undermines the security posture of affected websites. This flaw exists within the mstore_update_new_order_message function where proper nonce validation has been omitted, creating an exploitable condition that allows unauthenticated attackers to manipulate order notification messages. The vulnerability specifically targets the authentication mechanisms that should protect administrative functions within the WordPress ecosystem, exposing sensitive operational parameters to unauthorized modification.
The technical implementation of this vulnerability stems from the absence of cryptographic nonce verification within the targeted function. A nonce is a unique value generated for each user session that validates the authenticity of a request and prevents unauthorized actions from being executed on behalf of legitimate users. In this case, the mstore_update_new_order_message function fails to verify that incoming requests contain valid nonces, effectively allowing attackers to craft malicious requests that appear to originate from legitimate administrative sessions. This flaw operates under the principle that if an attacker can convince a site administrator to perform a specific action, such as clicking on a malicious link, they can execute unauthorized modifications to the system's order messaging configuration.
The operational impact of this vulnerability extends beyond simple message modification, as it represents a potential vector for broader system compromise and data manipulation. Attackers exploiting this weakness could alter critical order notification messages that administrators rely on for business operations, potentially leading to confusion during order processing or even facilitating more sophisticated attacks. The vulnerability particularly affects e-commerce environments where order notifications serve as critical communication channels between businesses and customers, making it especially dangerous for online stores that depend on the MStore API plugin for their operations. The unauthenticated nature of the attack means that no prior access or credentials are required, significantly increasing the attack surface and reducing the barrier to exploitation.
Security professionals should consider this vulnerability in the context of the broader ATT&CK framework, specifically under the technique of credential access and privilege escalation where CSRF attacks can serve as initial footholds for more extensive compromise. The weakness aligns with CWE-352, which categorizes cross-site request forgery vulnerabilities as a direct result of insufficient anti-CSRF protections in web applications. Organizations should implement immediate mitigations including updating to the patched version of the MStore API plugin, reviewing existing security configurations, and monitoring for suspicious administrative activities that might indicate exploitation attempts. Additionally, implementing additional security layers such as web application firewalls and regular security audits can help detect and prevent exploitation attempts, while educating administrators about the risks of clicking untrusted links remains a crucial defensive measure against this class of attack.