CVE-2023-3077
CRITICAL NUCLEIMStore API WordPress <3.9.8 - SQL Injection
Title source: llmExploitation Summary
CVE-2023-3077 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Nuclei Templates (1)
MStore API < 3.9.8 - SQL Injection
CRITICALVERIFIEDby DhiyaneshDK
Shodan:
http.html:/wp-content/plugins/mstore-api/
FOFA:
body=/wp-content/plugins/mstore-api/
References (1)
Core 1
Core References
Exploit, Third Party Advisory exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432
Scores
CVSS v3
9.8
EPSS
0.0487
EPSS Percentile
90.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
Status
published
Products (1)
inspireui/mstore_api
< 3.9.8
Published
Jul 10, 2023
Tracked Since
Feb 18, 2026