CVE-2020-36713

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.

• CWE-288
• CWE-306

• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/Exploit
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cveThird Party Advisory
• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-mstore-api-plugin/Exploit
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mstore-api-security-bypass-2-1-5/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36708The following themes for WordPress are vulnerable to Functio…9.8
• CVE-2020-36709The Page Builder: KingComposer plugin for WordPress is vulne…4.8
• CVE-2020-3671Use-after-free issue could occur due to dangling pointer whe…9.8
• CVE-2020-36710The WPS Hide Login plugin for WordPress is vulnerable to log…7.5
• CVE-2020-36711The Avada theme for WordPress is vulnerable to Stored Cross-…5.4
• CVE-2020-36712The Kali Forms plugin for WordPress is vulnerable to Unauthe…5.3
• CVE-2020-36714The Brizy plugin for WordPress is vulnerable to authorizatio…8.1
• CVE-2020-36715The Login/Signup Popup plugin for WordPress is vulnerable to…4.6
• CVE-2020-36716The WP Activity Log plugin for WordPress is vulnerable to au…7.3
• CVE-2020-36717The Kali Forms plugin for WordPress is vulnerable to Cross-S…8.8
• CVE-2020-36718The GDPR CCPA Compliance Support plugin for WordPress is vul…9.8
• CVE-2020-36719The ListingPro - WordPress Directory & Listing Theme for Wor…9.8