CVE-2020-36713 : Security Advisory and Response

The MStore API plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to create new administrator accounts, delete existing ones, or escalate privileges.

Understanding CVE-2020-36713

The vulnerability in the MStore API plugin for WordPress allows unauthorized access to critical routes, leading to potential privilege escalation.

What is CVE-2020-36713?

The CVE-2020-36713 vulnerability involves an authentication bypass in the MStore API plugin for WordPress versions up to 2.1.5, enabling attackers to perform malicious actions without proper authentication.

The Impact of CVE-2020-36713

The vulnerability poses a critical threat as it allows attackers to gain unauthorized access, create new admin accounts, delete existing ones, and escalate privileges on any account within affected versions of the MStore API plugin.

Technical Details of CVE-2020-36713

The technical details of the CVE-2020-36713 vulnerability provide insight into its description, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability in the MStore API plugin for WordPress up to version 2.1.5 allows unauthenticated users to exploit the 'register' and 'update_user_profile' routes, leading to potential admin account creation, deletion, or privilege escalation.

Affected Systems and Versions

Vendor: inspireui
Product: MStore API
Versions Affected: up to 2.1.5

Exploitation Mechanism

Attackers can exploit the unrestricted access to critical routes in the MStore API plugin, enabling them to perform unauthorized actions that compromise the security and integrity of WordPress installations.

Mitigation and Prevention

Mitigation strategies and preventive measures are crucial to address and safeguard systems from the CVE-2020-36713 vulnerability.

Immediate Steps to Take

Update the MStore API plugin to version 2.1.6 or higher to mitigate the vulnerability.
Monitor user accounts for any unauthorized changes or suspicious activities.

Long-Term Security Practices

Implement strong authentication mechanisms to prevent unauthorized access.
Regularly audit and review user privileges to ensure least privilege access.

Patching and Updates

Apply security patches promptly to ensure the latest fixes and enhancements are in place to protect against known vulnerabilities.