title: MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
description: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: MStore API
versions:
status: affected, versionType: custom, version: 0, lessThan: 3.9.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}