CVE-2025-11127

CRITICAL 9.8CVE-2025-11127 · Published 21/11/2025 · updated 19/10/2026

In short

CVE-2025-11127 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 29.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.

References

wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free