# CVE-2023-3277: MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

- Exploited (CISA KEV): no
- Published: 2023-11-03
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 2.9% (87th percentile)
- CWE: CWE-288

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-01-20 | 809 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-01-20 · new · rule 200013163
  > Added: signature 200013163 "Wordpress MStore Plugin Unauthorized Account Access" (Authentication/Authorization Attacks, risk Medium), systems: WordPress. References: CVE-2023-3277.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2026-07-07 · updated · rule 200013163
  > Updated: signature 200013163 "Wordpress MStore Plugin Unauthorized Account Access" (Authentication/Authorization Attacks, risk Medium), systems: WordPress. References: CVE-2023-3277.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2023-3277, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2023-3277, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2023-3277 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2023-3277