CVE-2023-3277
Published: 03 November 2023
Summary
CVE-2023-3277 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Inspireui Mstore Api. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The MStore API plugin for WordPress is affected by CVE-2023-3277, an improper implementation of the Apple login feature that permits unauthorized account access and privilege escalation. The flaw impacts all versions through 4.10.7 and carries a CVSS 3.1 score of 9.8, reflecting network-exploitable conditions with no required authentication or user interaction.
Unauthenticated attackers who know a target user's email address can exploit the weakness to authenticate as that user. Successful exploitation grants full account access, enabling arbitrary actions including privilege escalation depending on the victim's role.
Public references point to a patched version of the plugin released via the WordPress repository, with the fix committed in changeset 2988788. Administrators are advised to update immediately to a release newer than 4.10.7.
The EPSS score has remained at its recorded peak of 0.4720 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43952
Vulnerability details
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any…
more
user as long as they know the user's email address.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
Users can identify logons via alternate paths or channels by reviewing the previous logon time.
Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
Centralized IdPs close alternate authentication paths that enable bypass.
Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.
Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.