MStore API <= 3.9.6 - Missing Authorization

The MStore API plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions called via AJAX actions such as mstore_delete_json_file, mstore_update_limit_product, mstore_update_firebase_server_key, mstore_update_new_order_title, mstore_update_new_order_message, mstore_update_status_order_title, and mstore_update_status_order_message in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to perform several unauthorized actions that allow the attacker to control the plugins settings. This was partially patched in 3.9.6 but not fully patched until 3.9.7. CVE-2023-3209 Also applies to this vulnerability.