CVE-2023-2732: MStore API Authentication Bypass Flaw

CVE-2023-2732 Overview

The MStore API plugin for WordPress contains a critical authentication bypass vulnerability affecting versions up to and including 3.9.2. This security flaw stems from insufficient verification of user identity during the add listing REST API request. The vulnerability allows unauthenticated attackers to impersonate any existing user on the WordPress site, including administrators, by simply knowing the target user's ID.

Critical Impact

Unauthenticated attackers can gain complete administrative access to WordPress sites running vulnerable versions of MStore API, potentially leading to full site compromise, data theft, malware injection, and further attacks on site visitors.

Affected Products

• InspireUI MStore API plugin for WordPress versions up to and including 3.9.2
• WordPress installations using the MStore API plugin for mobile commerce functionality
• E-commerce sites leveraging MStore API for mobile app integration

Discovery Timeline

• May 25, 2023 - CVE-2023-2732 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-2732

Vulnerability Analysis

This authentication bypass vulnerability exists in the MStore API plugin's REST API endpoint handling for listing operations. The core issue lies in the class.api.fields.php file within the listing REST API controller, where user verification is inadequately implemented. When processing add listing requests, the plugin fails to properly validate that the requesting user is actually authenticated and authorized to perform actions as the specified user.

The vulnerability is particularly severe because it requires no authentication to exploit. An attacker only needs to know or guess a valid user ID on the target WordPress site. User IDs in WordPress typically start from 1 and increment sequentially, making enumeration trivial. The first user (ID 1) is almost always the site administrator, making this a high-value target for attackers.

Root Cause

The root cause of this vulnerability is improper access control in the MStore API plugin's REST API implementation. The plugin accepts a user ID parameter in the add listing API request but fails to verify that the requester has the authority to act on behalf of that user. This represents a classic Broken Access Control weakness where the application trusts client-supplied input for authentication decisions without proper server-side validation.

The vulnerable code path exists in the listing REST API controller where user context is established based on request parameters rather than authenticated session data. This design flaw allows any external party to specify an arbitrary user ID and receive authentication tokens or session access for that user.

Attack Vector

The attack is network-based and can be executed remotely without any prior authentication. An attacker would target the add listing REST API endpoint exposed by the MStore API plugin. The attack flow involves:

1. Identifying a WordPress site running a vulnerable version of MStore API
2. Crafting a malicious REST API request to the add listing endpoint
3. Specifying a target user ID (commonly ID 1 for administrator access)
4. Receiving authentication credentials or session access for the specified user
5. Using the obtained access to perform administrative actions on the WordPress site

The vulnerability requires no user interaction and can be automated for mass exploitation. Since the attack targets a REST API endpoint, it bypasses traditional web application firewall rules that focus on form-based authentication attacks.

Detection Methods for CVE-2023-2732

Indicators of Compromise

• Unexpected REST API requests to /wp-json/mstore-api/ endpoints from unknown IP addresses
• Authentication logs showing administrator logins from unfamiliar locations or IP addresses
• New administrator accounts or privilege escalation for existing non-admin users
• Modifications to site content, themes, or plugins without authorized changes
• Unusual API activity patterns targeting the MStore API listing endpoints

Detection Strategies

• Monitor WordPress REST API access logs for anomalous requests to MStore API endpoints
• Implement alerting on authentication events for administrator accounts, especially from new IP addresses or geographic locations
• Deploy web application firewall rules to detect suspicious patterns in REST API requests
• Review WordPress user activity logs for unauthorized changes to user roles or permissions
• Audit plugin configurations and installed plugins for unexpected modifications

Monitoring Recommendations

• Enable comprehensive logging for WordPress REST API endpoints, particularly those related to MStore API
• Configure real-time alerting for administrator login events and privilege changes
• Implement IP-based rate limiting on REST API endpoints to slow down exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to monitor web server processes for post-exploitation activity

How to Mitigate CVE-2023-2732

Immediate Actions Required

• Update the MStore API plugin to version 3.9.3 or later immediately
• Audit all WordPress user accounts for unauthorized access or privilege changes
• Review recent administrator login history for suspicious activity
• Check for unauthorized content modifications, new plugins, or theme changes
• Consider temporarily disabling the MStore API plugin if immediate update is not possible

Patch Information

InspireUI has released a security update addressing this vulnerability. The fix is available in the WordPress Changeset which implements proper user verification in the REST API request handling. Site administrators should update to version 3.9.3 or later through the WordPress plugin update mechanism. The vulnerability details and technical analysis are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the MStore API plugin entirely if not actively required for site functionality
• Implement IP-based access restrictions on the WordPress REST API at the web server or firewall level
• Use a web application firewall (WAF) to block requests to MStore API endpoints from untrusted sources
• Consider implementing additional authentication layers such as application-level passwords for API access

# Apache .htaccess workaround to restrict MStore API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/mstore-api/ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
RewriteRule .* - [F,L]
</IfModule>