An Đặng

The issue is related to a missing capability check on the `delete resmush list()` function, allowing authenticated attackers with minimal permissions, such as a subscriber, to delete the resmush list for Nextgen or the Media Library. This enables unauthorized deletion of the resmush list.

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address. The issue was escalated to the plugin's team 30 days ago, but a patch has not yet been released.

The issue allows unauthenticated attackers to perform Blind SQL Injection via the `id` parameter due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.