9.8
Critique
CVE-2025-11127 The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly…
Description
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Mstoreapp Mobile App 2.0 | premières → 2.0.8 | Pas de correctif indiqué |
| Mstoreapp Mobile Multivendor 9.0 | premières → 9.0.1 | Pas de correctif indiqué |