CVE-2023-3202: 
WordPress vulnerability analysis and mitigation

The MStore API plugin for WordPress (versions up to 3.9.6) contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2023-3202. The vulnerability exists in the mstoreupdatefirebaseserverkey function due to missing nonce validation, which was discovered and disclosed in July 2023 (NVD).

The vulnerability stems from the lack of nonce validation in the mstoreupdatefirebaseserverkey function, which handles the updating of firebase server keys for push notifications when order status changes. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (Wordfence).

If exploited, this vulnerability allows unauthenticated attackers to modify the firebase server key used for push notifications. The impact is limited but could affect the notification system's functionality when order statuses change (NVD).

The vulnerability has been patched in newer versions of the plugin. Site administrators should update to a version newer than 3.9.6 to protect against this vulnerability. The fix includes proper nonce validation implementation for the affected function (NVD).