CVE-2025-11127CRITICAL 9.8EPSS p19.8%

CVE-2025-11127CVE-2025-11127

Description

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.28% probability of exploitation · percentile 19.8% · 2026-06-18T12:00:27Z
Published2025-11-21
Last modified2026-04-15

References

  1. https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-10484
CVE
CVE-2025-2594
CVE
CVE-2025-7612
CVE
CVE-2026-3326
CVE
CVE-2025-1475
CVE
CVE-2025-1061
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.