Access violation vulnerability in MStore API 3.9.6

The MStore API plugin for WordPress can be manipulated by attackers with minimal permissions (even a subscriber) to change the plugin’s settings without authorization. This vulnerability was found in all versions up to 3.9.5, and is caused by the lack of capability checks on several functions called via AJAX actions. Examples of these functions include mstore_delete_json_file, mstore_update_limit_product, mstore_update_firebase_server_key, mstore_update_new_order_title, mstore_update_new_order_message, mstore_update_status_order_title, and mstore_update_status_order_message.