critical9.8
CVE-2025-11127
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX …
Impact
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
Affected products
| Product | Affected versions |
|---|---|
| Mstoreapp Mobile App WordPress Plugin | through 2.08 |
| Mstoreapp Mobile Multivendor | through 9.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.