Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension
There's been no patch released by the actual vendor - Magestore
Does anyone know:
- What the vulnerability is?
- How to patch it?
I've created a github repo that holds the original code of this extension, so you can see what the code is and perhaps see what the vulnerability is and suggest a patch?
The scope of functionality and code are available on the public github repo.
Magestore released a patch, it can be found here https://blog.magestore.com/store-locator-extension-patch/
According to them
Please note that customers using Magento 1 are not affected by this issue.