CVE-2020-36713 Information

Description

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.1.5. This is due to unrestricted access to the ‘register’ and ‘update_user_profile’ routes. This makes it possible for unauthenticated attackers to create new administrator accounts delete existing administrator accounts or escalate privileges on any account.

Reference

https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/ https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/ https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cve