CVE-2023-3203: 
WordPress vulnerability analysis and mitigation

The MStore API plugin for WordPress (versions up to 3.9.6) contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2023-3203. The vulnerability was discovered in the mstore_update_limit_product function due to missing nonce validation, which was disclosed on June 13, 2023 (NVD).

The vulnerability stems from the absence of nonce validation in the mstore_update_limit_product function within the MStore API WordPress plugin. This security flaw has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating a network-accessible vulnerability with low attack complexity that requires user interaction (Wordfence).

The vulnerability allows unauthenticated attackers to update and limit the number of products per category to use cache data in the home screen, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (NVD).

Users should update to a version newer than 3.9.6 of the MStore API plugin for WordPress, which includes patches for this vulnerability. The fix implements proper nonce validation for the affected function (NVD).