CVE-2023-3277 — AI Deep Analysis Summary

🚨 **Essence**: A critical flaw in the **MStore API** WordPress plugin allows **unauthenticated attackers** to log in as any user.…

🛡️ **Root Cause**: **Improper Implementation of Authentication** (CWE-288). <br>🔍 **Flaw**: The **Apple Login** feature is broken.…

📦 **Affected**: **WordPress Plugin: MStore API**. <br>📉 **Versions**: **4.10.7 and earlier**. <br>🏢 **Vendor**: inspireui. <br>⚠️ **Note**: Affects sites using this specific plugin for Android/iOS app integration.

👤 **Privileges**: **Full User Account Access**. <br>🔓 **Data**: Attackers can access **any user's profile data**, posts, and settings associated with that account.…

📉 **Threshold**: **VERY LOW**. <br>🔑 **Auth**: **None required** (Unauthenticated). <br>📧 **Requirement**: Only need to **know the victim's email address**. <br>🎯 **UI**: No user interaction needed.…

💻 **Public Exp?**: **YES**. <br>📂 **PoC**: Available via **Nuclei Templates** (projectdiscovery). <br>🌍 **Status**: Actively exploitable.…

🔍 **Self-Check**: <br>1. Check your WordPress plugins for **MStore API**. <br>2. Verify version is **≤ 4.10.7**. <br>3. Use scanners like **Nuclei** with the CVE-2023-3277 template. <br>4.…

🛠️ **Fix**: **YES**, officially patched. <br>📥 **Action**: Update **MStore API** to the latest version immediately. <br>🔗 **Ref**: Check WordPress Trac or vendor site for the fixed release (post-4.10.7).

🚧 **No Patch Workaround**: <br>1. **Disable** the MStore API plugin temporarily. <br>2. **Restrict** Apple Login feature if possible. <br>3. **Monitor** logs for suspicious login attempts using known email addresses.…

🔥 **Urgency**: **CRITICAL / IMMEDIATE**. <br>⚡ **Priority**: **P0**. <br>📢 **Reason**: Unauthenticated access + known email = instant account takeover. Patch immediately to prevent data breaches and site hijacking.