{"basis":"claimed","id":"CVE-2023-3277","name":"MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation","vendorProject":"inspireui","product":"MStore API – Create Native Android & iOS Apps On The Cloud","publishedAt":"2023-11-03","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":null,"epss":{"score":0.02888,"percentile":0.86885,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-01-20","daysToRule":809},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation","description":"The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.","cwes":["CWE-288"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-01-20","firstIsNew":true,"daysToRule":809,"daysAtMost":null,"freePlan":false,"claims":[{"id":"a1a5191faad7ae867cd4f2a6fe704ce2f8786abb59fc36da4e786e78115fe162","cve_id":"CVE-2023-3277","vendor":"f5","product":"Attack signatures","rule_id":"200013163","rule_name":"Wordpress MStore Plugin Unauthorized Account Access","change":"new","default_action":null,"published_on":"2026-01-20","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013163 \"Wordpress MStore Plugin Unauthorized Account Access\" (Authentication/Authorization Attacks, risk Medium), systems: WordPress. References: CVE-2023-3277.","first_seen_at":"2026-11-02T21:00:25.080Z"},{"id":"cb35ef8b503069c64f27dd55c3c05898f744a053a929c361bfb843b2b734390a","cve_id":"CVE-2023-3277","vendor":"f5","product":"Attack signatures","rule_id":"200013163","rule_name":"Wordpress MStore Plugin Unauthorized Account Access","change":"updated","default_action":null,"published_on":"2026-07-07","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200013163 \"Wordpress MStore Plugin Unauthorized Account Access\" (Authentication/Authorization Attacks, risk Medium), systems: WordPress. References: CVE-2023-3277.","first_seen_at":"2026-11-02T21:00:24.693Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:15:26.211Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2023-3277","templatePath":"http/cves/2023/CVE-2023-3277.yaml","requests":1,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"POST","path":"/wp-json/api/flutter_user/apple_login","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2023-3277","templatePath":"http/cves/2023/CVE-2023-3277.yaml","requests":1,"blockedRequests":1,"rules":["942120"],"note":"","requestDetail":[{"method":"POST","path":"/wp-json/api/flutter_user/apple_login","status":403,"blocked":true,"rules":["942120"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}