Description
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MStore API | < 4.21.0 | 4.21.0 |
References
- https://wpscan.com/vulnerability/0e7d8a17-0901-45b5-959c-2c1ef1316047/ exploit vdb-entry technical-description