This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A critical authentication bypass in the MStore API plugin.β¦
π‘οΈ **Root Cause**: CWE-288 (Authentication Bypass). The flaw lies in the logic of `flutter-user.php` (lines 699-714), allowing unauthorized access to protected endpoints.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: WordPress Plugin **MStore API β Create Native Android & iOS Apps On The Cloud**. π’ **Vendor**: inspireui. β οΈ **Version**: 4.14.7 and earlier.
Q4What can hackers do? (Privileges/Data)
π **Attacker Capabilities**: Since PR (Privileges Required) is NONE, anyone can exploit this. They can access sensitive user data, modify content, and potentially take over admin functions.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: VERY LOW. π Network Accessible (AV:N). Low Complexity (AC:L). No User Interaction needed (UI:N). No authentication required (PR:N). Easy to exploit!
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Status**: No public PoC code listed in the data. However, the CVSS score is 9.8 (Critical), implying high exploitability. Wild exploitation is likely given the low barrier.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for the plugin **MStore API** version β€ 4.14.7. Check if endpoints in `controllers/flutter-user.php` are accessible without valid tokens/cookies.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fix**: Yes, an official fix exists. Update to the latest version via WordPress Trac (Changeset 3115231). Patch addresses the bypass in the user controller.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Isolate the plugin. Restrict access to `/wp-admin` and API endpoints via WAF rules. Block direct access to `flutter-user.php` if possible. Disable the plugin temporarily.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: CRITICAL. π¨ CVSS 9.8. Published July 2024. Immediate patching is required to prevent unauthorized access and data breaches.