Description
WordPress Plugin MStore API-Create Native Android & iOS Apps On The Cloud is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently take over any account. WordPress Plugin MStore API-Create Native Android & iOS Apps On The Cloud version 3.1.9 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.2.0 or latest
References
https://blog.webble.fr/critical-authentication-bypass-in-mstore-api/
https://sploitus.com/exploit?id=WPEX-ID:BF5DDC43-974D-41FA-8276-C1A27D3CC882
https://plugins.svn.wordpress.org/mstore-api/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin jRSS Widget 'url' Parameter Directory Traversal (1.1.1)
MySQL CVE-2019-2740 Vulnerability (CVE-2019-2740)
MediaWiki Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-9476)
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-6819)
WordPress Plugin Malware Scanner Privilege Escalation (4.7.2)