Threats tagged 'ghsa-9px3-jf5v-3473'

The MStore API WordPress plugin before version 4.21.0 contains a missing authorization vulnerability in its REST product-review creation endpoint. This flaw allows unauthenticated attackers to submit WooCommerce product reviews with arbitrary reviewer names, emails, and star ratings, even on stores configured to accept reviews only from verified owners. The vulnerability is identified as CWE-862 (Missing Authorization) and has a high severity rating with a CVSS score of 7.5.