CVE-2020-36713

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@wordfence.com

Published

2023-06-07

Last modified

2026-04-08

Weaknesses

CWE-288, CWE-306

Affected products

• Mstore Api (Inspireui)
• Mstore Api Create Native Android Ios Apps On The Cloud (Inspireui)

References

• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cve