CVE-2024-12042
📋 TL;DR
The MStore API WordPress plugin has a stored XSS vulnerability in profile picture upload functionality. Authenticated attackers with subscriber-level access can upload malicious HTML files that execute scripts when accessed. This affects all versions up to 4.16.4.
💻 Affected Systems
- MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin
📦 What is this software?
Mstore Api by Inspireui
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors through script execution.
Likely Case
Attackers with subscriber accounts upload malicious HTML files that execute scripts when viewed, potentially stealing session cookies or performing actions as the viewing user.
If Mitigated
With proper file type validation and content security policies, the risk is limited to file storage abuse without script execution.
🎯 Exploit Status
Exploitation requires authenticated access but only subscriber-level permissions. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3205338/mstore-api/trunk/functions/index.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MStore API plugin. 4. Click 'Update Now' if update available. 5. If no update available, download version 4.16.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate mstore-api
Restrict file uploads
linuxUse .htaccess or web server configuration to block HTML file uploads
<FilesMatch "\.(html|htm)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove subscriber upload permissions via custom code or user role editor plugins
- Implement web application firewall rules to block HTML file uploads to the affected endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → MStore API version. If version is 4.16.4 or lower, you are vulnerable.Check Version:
wp plugin get mstore-api --field=versionVerify Fix Applied:
After updating, verify plugin version is 4.16.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML file uploads via MStore API endpoints
- Multiple failed upload attempts with different file extensions
Network Indicators:
- POST requests to /wp-content/plugins/mstore-api/upload endpoints with HTML file content
SIEM Query:
source="wordpress.log" AND "mstore-api" AND "upload" AND ("html" OR "htm")