MStore API < 3.9.8 - SQL Injection

披露于 2023/07/10 · 更新于 2025/10/30

CVSS 评分9.8/ 10.0

EPSS 概率34.6%百分位 96.8%

漏洞描述

The MStore API WordPress plugin before 3.9.8 is vulnerable to Blind SQL injection via the product_id parameter.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 mstore_api 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2023-3197 WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection mstore_api	严重	—	—	PoCEXP	2026/02/26
CVE-2023-3277 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation mstore_api	严重	9.8	—	PoCEXP	2023/11/03
wp_mstore_plugin_listing Wordpress Plugin MStore API mstore_api	低危	—	—	PoCEXP	2023/10/20
CVE-2023-2734 MStore API <= 3.9.1 - Authentication Bypass mstore_api	严重	9.8	—	PoCEXP	2023/05/25
CVE-2023-2732 MStore API <= 3.9.2 - Authentication Bypass mstore_api	严重	9.8	90.1%	PoCEXP	2023/05/25