Security readout for executives and security teams
Plain-English summary
MStore API for WordPress before 3.9.7 reportedly let low-privileged users change settings because many AJAX actions lacked authorization and/or nonce protection. That can undermine site configuration and business operations, especially on sites allowing subscriber accounts.
Executive priority
Handle as a targeted WordPress plugin exposure, not a confirmed active-exploitation emergency. Prioritize affected ecommerce or mobile-app-connected sites, especially those with public registration or many low-privileged users.
Technical view
CVE-2023-3131 is a CWE-862 missing authorization issue in the MStore API WordPress plugin before 3.9.7. The source states most AJAX actions lacked privilege checks, nonce checks, or both, enabling Subscriber+ unauthorized settings updates. No CVSS score is provided in the bundle.
Likely exposure
Exposure is likely limited to WordPress sites running MStore API before 3.9.7. Risk is higher where untrusted users can register or already hold Subscriber-level accounts. The affected-version metadata is sparse, so confirm installed plugin version directly.
Exploitation context
WPScan tags the entry as exploit-related, but the provided bundle does not show CISA KEV listing or confirmed active exploitation. Treat public exploit information as available, without claiming in-the-wild exploitation.
Researcher notes
The evidence supports missing authorization/nonce controls on AJAX actions before 3.9.7. The bundle does not provide CVSS, full affected CPEs, or detailed impact boundaries. Avoid assuming data theft or remote unauthenticated compromise from these sources alone.
Mitigation direction
- Upgrade MStore API to version 3.9.7 or later.
- Restrict or review Subscriber-level account access until upgraded.
- Check vendor and plugin changelog guidance for complete remediation details.
- Review plugin settings for unauthorized changes after remediation.
Validation and detection
- Inventory WordPress sites for the MStore API plugin.
- Confirm installed versions are 3.9.7 or later.
- Review WordPress users with Subscriber or higher roles.
- Check recent plugin setting changes and administrative audit logs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-3131 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6cCVE reference · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.