Vulnerability · Published Jul 10, 2023 · Assigned by WPScan

CVE-2023-3077MStore API < 3.9.8 - Unauthenticated Blind SQLi

Critical 9.8

In plain English

A critical-severity security flaw in MStore API from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)5.5%top 7.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.

Affected products (as reported)

Vendor	Product	Versions
Unknown	MStore API	0 – before 3.9.8

References

https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432 exploit, vdb-entry, technical-description