CVE-2024-8269: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8269?
The severity of CVE-2024-8269 is considered moderate due to unauthorized user registration risks.
How do I fix CVE-2024-8269?
To fix CVE-2024-8269, upgrade the MStore API plugin to version 4.15.4 or later.
What versions are affected by CVE-2024-8269?
All versions of the MStore API plugin up to and including 4.15.3 are affected by CVE-2024-8269.
What causes CVE-2024-8269?
CVE-2024-8269 is caused by the plugin not checking if user registration is enabled before creating a user account.
Who is at risk due to CVE-2024-8269?
WordPress sites using affected versions of the MStore API plugin are at risk of unauthorized user registration due to CVE-2024-8269.