Critical · published November 21, 2025
🚨 A simple AJAX call could let anyone steal valid user sessions just by knowing an email address! Think of it like a hotel receptionist handing out room keys to anyone who just asks for them by name — no ID or verification needed. It’s a recipe for disaster! An attacker could access any user's account, read their messages, change their settings, or even make purchases. This could lead to identity theft, unauthorized transactions, and a loss of trust from users. The consequences are absolutely devastating!
Think of it like a hotel receptionist handing out room keys to anyone who just asks for them by name — no ID or verification needed. It’s a recipe for disaster! The Mstoreapp Mobile App and Mstoreapp Mobile Multivendor plugins fail to properly verify user identities when handling AJAX requests, allowing unauthenticated users to impersonate any user by retrieving their active session using just their email address.
An attacker could access any user's account, read their messages, change their settings, or even make purchases. This could lead to identity theft, unauthorized transactions, and a loss of trust from users. The consequences are absolutely devastating! Immediately update the Mstoreapp Mobile App plugin to version 2.09 and the Multivendor plugin to version 9.0.2. Additionally, review and tighten user authentication processes for AJAX actions to prevent future vulnerabilities. You’ve got this! Follow these steps to secure your site and keep your users safe! 🛡️