CVE-2025-11127 — Vulnerability intelligence
— Mstoreapp Mobile App, Mstoreapp Mobile Multivendor
Published:
- CVSS
- 9.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.