blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-11127

CRITICAL 9.8 CVSS 3.1
Published
November 21, 2025
Last modified
October 19, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

Affected products and versions

  • Unknown Mstoreapp Mobile App — Up to and including 2.0.8
  • Unknown Mstoreapp Mobile Multivendor — Up to and including 9.0.1

References

  • wpscan.com https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/
  • nvd.nist.gov Official NVD record