What is CVE-2025-11127?

CVE-2025-11127 is a critical-severity vulnerability in Mstoreapp Mobile App, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 9.8/10. Published 2025-11-21.

How severe is CVE-2025-11127?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Mstoreapp Mobile App

CVE-2025-11127

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

EPSS: 0.003 (24.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Unknown Mstoreapp Mobile App — versions 0
Unknown Mstoreapp Mobile Multivendor — versions 0

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2025-11127?: CVE-2025-11127 is a critical-severity vulnerability in Mstoreapp Mobile App, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 9.8/10. Published 2025-11-21.
How severe is CVE-2025-11127?: Critical severity. CVSS v3 base score is 9.8 out of 10.