What’s Vulnerable › Vulnerabilities

CVE-2023-3131: MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-10 · updated 2026-06-17

Description

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

Affected products

• inspireui MStore API – Create Native Android & iOS Apps On The Cloud: before 3.9.7 — fixed in 3.9.7

How to fix

Upgrade to a fixed version: inspireui MStore API – Create Native Android & iOS Apps On The Cloud 3.9.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c
• https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c

Get alerted when CVE-2023-3131 or the next vulnerability affects your stack