Critical · published May 25, 2023
🚨 An unauthenticated attacker can log in as any user on your WordPress site, including admins! That's right, just by exploiting a flaw in the MStore API plugin up to version 3.9.0. 🔥 This vulnerability is like a delivery person who ignores the signature verification and just hands over packages to anyone claiming to be the recipient — no checks, no questions asked! An attacker could waltz right in and hijack an admin account, giving them complete control over your website. Imagine them changing settings, stealing data, or even launching further attacks — it's absolutely devastating!
This vulnerability is like a delivery person who ignores the signature verification and just hands over packages to anyone claiming to be the recipient — no checks, no questions asked! This authentication bypass occurs because the MStore API plugin fails to properly verify user credentials during coupon redemption requests, allowing attackers to log in as any existing user if they know the user ID.
An attacker could waltz right in and hijack an admin account, giving them complete control over your website. Imagine them changing settings, stealing data, or even launching further attacks — it's absolutely devastating! Immediately update the MStore API plugin to version 3.9.1 or later to patch this vulnerability. Also, review your user access logs for any suspicious activity and consider implementing additional user verification measures. You've got this! With these steps, you can secure your site and activate your security hero status! 🛡️