CVE-2023-3209: 
WordPress vulnerability analysis and mitigation

The MStore API WordPress plugin before version 3.9.7 contains a security vulnerability identified as CVE-2023-3209. The vulnerability stems from the plugin's failure to implement proper security controls for most of its AJAX actions, specifically lacking privilege checks and nonce checks (WPScan).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, resulting in low impact to integrity with no impact to confidentiality or availability (NVD).

When exploited, this vulnerability allows authenticated users with subscriber-level access to modify various plugin settings without proper authorization. This includes the ability to change product limits, Firebase server keys, order titles, and order messages (WPScan).

The vulnerability has been patched in version 3.9.7 of the MStore API plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).