CVE-2025-11127 — Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation

CVE-2025-11127

Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation PUBLISHED

Description (CNA)

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

Affected (CNA)

Vendor / product	Versions
Unknown / Mstoreapp Mobile App	affected 0 through 2.0.8
Unknown / Mstoreapp Mobile Multivendor	affected 0 through 9.0.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.