Security readout for executives and security teams
Plain-English summary
CVE-2023-3202 lets an attacker trick a logged-in WordPress administrator into changing the MStore API plugin Firebase server key. The issue affects MStore API versions described as 3.9.6 and earlier. The business impact is limited but real: push notification behavior tied to order status changes could be altered without the admin intending it.
Executive priority
Treat this as a moderate-priority WordPress plugin issue. It is unlikely to cause full site compromise by itself, but it can affect customer-facing notification workflows and may indicate broader admin-session CSRF exposure if left unpatched.
Technical view
The WordPress MStore API plugin lacked nonce validation in mstore_update_firebase_server_key, creating a CSRF weakness. Exploitation requires user interaction from a site administrator and results in limited integrity impact by updating the Firebase server key used for push notifications when order status changes.
Likely exposure
Exposure is limited to WordPress sites using the MStore API plugin, especially versions 3.9.6 or earlier. Sites without the plugin are not affected. The CVE record has incomplete CPE detail, so asset owners should validate by plugin inventory rather than relying only on scanner matching.
Exploitation context
The provided sources do not show known active exploitation, and the CVE is not listed as KEV. Exploitation is not unaided: an attacker must induce a logged-in administrator to perform an action, such as following a crafted link.
Researcher notes
The evidence identifies CWE-352 CSRF caused by missing nonce validation in mstore_update_firebase_server_key. The affected-version evidence is stronger in the title and vulnerability description than in structured CPE data. Avoid claiming broader impact beyond Firebase server key updates and related order-status push notifications.
Mitigation direction
- Inventory WordPress sites for the MStore API plugin and record installed versions.
- Update affected installations from version 3.9.6 or earlier using vendor or WordPress plugin guidance.
- Restrict administrator browsing while logged in and reinforce phishing-resistant admin workflows.
- Review Firebase server key settings and rotate keys if unauthorized changes are suspected.
- Monitor WordPress admin activity and notification behavior for unexpected configuration changes.
Validation and detection
- Confirm whether MStore API is installed and whether the version is 3.9.6 or earlier.
- Review the relevant handler for nonce validation around Firebase server key updates.
- Check WordPress plugin update history for the referenced changeset and installed plugin version.
- Inspect recent configuration changes to the Firebase server key setting.
- Verify no unexpected push notification behavior occurred around order status changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-3202 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.