Critical severity9.8NVD Advisory· Published Jul 10, 2023· Updated Jun 17, 2026

CVE-2023-3076

Description

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Inspireui/Mstore API
cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*
Range: <3.9.9
WordPress/Mstore APIcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.9.9
Package: https://wordpress.org/plugins/mstore-api

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5bnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000