CVE-2025-3438 — Improper Privilege Management in Mstore API

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.3HIGHNVD
CNA6.5
EPSS
0.5%
top 34.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Inspireui Mstore APIInspireui Mstore API Create Native Android IOS Apps ON THE Cloud
Timeline
PublishedMay 2

Description

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶NVDinspireui/mstore_api< 4.17.5

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation↗2025-05-02
▶
GHSA
GHSA-f367-gfrg-qv3c: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up t↗2025-05-02
▶
CVE-2025-3438 — Improper Privilege Management | cvebase