CVE-2025-11127

CVE-2025-11127 is a critical authentication bypass vulnerability affecting the Mstoreapp Mobile App WordPress plugin through version 2.08 and the Mstoreapp Mobile Multivendor plugin through version 9.0.1. These plugins fail to properly verify user identity during an AJAX action, enabling attackers to obtain a valid session token for any arbitrary user account simply by knowing the target's email address. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete compromise of affected user sessions.

Unauthenticated attackers with network access can exploit this flaw remotely with low complexity and no user interaction required. By submitting a crafted AJAX request with a known email address, an attacker can retrieve an active session for that user, potentially granting full access to their account privileges, including administrative capabilities if targeting an admin user. This could lead to unauthorized data access, account takeover, and further site compromise.

The WPScan advisory at https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/ provides additional details on the vulnerability, including potential mitigation steps such as updating to patched versions where available or disabling the affected AJAX endpoints.