Ver todas as ameaças

CVE-2023-3277

Alvo: Não informado

Descrição

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user’s email address. We are disclosing this issue as the developer has not yet released a patch, but continues to release updates and we escalated this issue to the plugin’s team 30 days ago.

Software
Não informado
Tipo Software
Plugin
CVE
CVE-2023-3277
Tags
Nâo informado
Data de publicação
03/11/2023
Última atualização
08/12/2024
Pontuação em CVSS 3.0
9.8
Crítico
Rolar para cima