An Đặng

O problema está relacionado à falta de uma verificação de permissão na função `delete resmush list()`, permitindo que invasores autenticados com permissões mínimas, como um assinante, excluam a lista resmush do Nextgen ou da Biblioteca de Mídia. Isso possibilita a exclusão não autorizada da lista resmush.

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address. The issue was escalated to the plugin's team 30 days ago, but a patch has not yet been released.

The issue allows unauthenticated attackers to perform Blind SQL Injection via the `id` parameter due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.