CVE-2023-3076: MStore API < 3.9.9 - Unauthenticated Privilege Escalation

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-862

Description

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.

Affected products

inspireui MStore API – Create Native Android & iOS Apps On The Cloud: before 3.9.9 — fixed in 3.9.9

How to fix

Upgrade to a fixed version: inspireui MStore API – Create Native Android & iOS Apps On The Cloud 3.9.9. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b
https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b

Get alerted when CVE-2023-3076 or the next vulnerability affects your stack