July 10, 2023, 4:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.

access accounts api cve endpoint features paid plugin pro rest rest api role wholesale wordpress wordpress plugin

IT Security Manager

@ Timocom GmbH | Erkrath, Germany

Cybersecurity Service Engineer

@ Motorola Solutions | Singapore, Singapore

Sr Cybersecurity Vulnerability Specialist

@ Health Care Service Corporation | Chicago Illinois HQ (300 E. Randolph Street)

Associate, Info Security (SOC) analyst

@ Evolent | Pune

Public Cloud Development Security and Operations (DevSecOps) Manager

@ Danske Bank | Copenhagen K, Denmark

Cybersecurity Risk Analyst IV

@ Computer Task Group, Inc | United States