Critical severity · published Jul 10, 2023
CVE-2023-3076
MStore API < 3.9.9 - Unauthenticated Privilege Escalation
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MStore API ·
before 3.9.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3076
Exploit
https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b
More from MStore API
9.8
CVE-2023-3077
MStore API < 3.9.8 - Unauthenticated Blind SQLi
9.1
CVE-2026-16038
MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
8.1
CVE-2026-16030
MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
7.5
CVE-2026-16041
MStore API < 4.21.0 - Unauthenticated Product Review Creation
6.5
CVE-2026-18234
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet