CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects WordPress. Exploitation may require the attacker to be authenticated.
CVE
CVE-2020-36713
Severity
CRITICAL
CVSS
9.8
EPSS
1.60%
WordPress
Original NVD Description
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
Related CVEs
Other vulnerabilities affecting the same vendor(s)