9.8
Critical
CVE-2025-11127 The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly…
Description
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mstoreapp Mobile App 2.0 | earliest → 2.0.8 | No fix stated |
| Mstoreapp Mobile Multivendor 9.0 | earliest → 9.0.1 | No fix stated |