CyberRota Analysis
AI-GeneratedThe MStore API plugin for WordPress prior to version 4.21.0 is vulnerable due to a lack of authorization checks on its REST product-review creation route, enabling unauthenticated attackers to submit fraudulent WooCommerce product reviews. This could lead to the manipulation of product ratings and damage to store reputation, particularly for stores that restrict reviews to verified owners. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.