S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 1, 2025

CVE-2023-2734 Scanner

Exploits the cart synchronization endpoint to authenticate as any user without a password, enabling full account takeover.

Est. Time~1 minutes
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2.2k
Times Used
continuous scan runs
5.5k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2023-2734
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
MStore API – Create Native Android & iOS Apps On The Cloudby inspireui
0
Updated Aug 22, 2026View on NVD →
Detail

The MStore API is a popular WordPress plugin by InspireUI that bridges mobile applications with WordPress sites, enabling seamless content synchronization and e-commerce functionality. Web developers and site administrators rely on it to manage shopping carts, orders, and user data across platforms. Its integration is critical for businesses aiming to provide a unified mobile and web experience, handling sensitive user interactions and transactions.

CVE-2023-2734 is an authentication bypass vulnerability that arises from insufficient user verification during the cart synchronization process. The plugin fails to properly validate user identity when processing API requests, allowing attackers to manipulate authentication tokens. This flaw stems from insecure handling of user IDs and session data within the REST API endpoints.

Specifically, the vulnerability targets the cart synchronization endpoint, where the plugin accepts user-supplied identifiers without adequate checks. An attacker can craft a request with a manipulated user ID parameter, bypassing the need for valid credentials. This endpoint is designed to sync cart data between mobile apps and the WordPress backend, but its flawed logic enables unauthorized access.

If exploited, an attacker can authenticate as any existing user, including administrators, leading to complete site compromise. They can modify content, access sensitive data, install malicious plugins, or deface the site. Given the CVSS score of 9.8, this vulnerability poses a critical risk to all WordPress sites using vulnerable MStore API versions.

Solution Advice
  • Update the MStore API plugin to version 3.9.2 or later immediately.
  • Implement strict user ID validation and session checks on all REST API endpoints.
  • Disable the cart synchronization endpoint if not required for mobile app functionality.
  • Review and harden authentication mechanisms, ensuring tokens are cryptographically signed.
  • Enable multi-factor authentication for all user roles, especially administrators.
  • Regularly audit WordPress plugins and apply security patches promptly.
  • Monitor server logs for suspicious API requests targeting user authentication endpoints.
  • Use a web application firewall to block malicious payloads targeting CVE-2023-2734.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →
Similar Tools
critical
CVE-2024-9643 Scanner
→high
CVE-2026-1603 Scanner
→critical
CVE-2025-40552 Scanner
→high
CVE-2026-41432 Scanner
→critical
TP-LINK WR840N Improper Authentication Scanner
→critical
CVE-2026-20079 Scanner
→critical
CVE-2025-9209 Scanner
→high
CVE-2026-1368 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.