CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Score

CVSS 3.1 9.8 Critical

Status

Modified - contact@wpscan.com

Published

2021-03-18

Last modified

2024-08-03

Weaknesses

CWE-287

Affected products

• Mstore Api (Inspireui)
• Mstore Api (Unknown)

References

• https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882