Vulnerability CVE-2020-36713
Published: 2023-06-07

Description:
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.

 References:
https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/
https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cve
Copyright 2026, cxsecurity.com

 

Back to Top