{"id":"CVE-2025-3438","aliases":["EUVD-2025-13296","GHSA-f367-gfrg-qv3c"],"status":"published","title":"MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.17.4 - Unauthenticated Limited Privilege Escalation","description":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00341,"percentile":0.27756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2025-05-02T05:22:34Z","modified":"2026-06-17T09:19:57Z","products":[{"vendor":"inspireui","product":"mstore api – create native android \u0026 ios apps on the cloud"},{"vendor":"inspireui","product":"mstore_api"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5d86ad-f94b-4fcb-9b74-ecddde2bf29d?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L392","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L413","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/changeset/3277790","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/3279132/","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3438"},{"url":"https://plugins.trac.wordpress.org/changeset/3279132"},{"url":"https://github.com/advisories/GHSA-f367-gfrg-qv3c"}],"sources":{"cve":[{"id":"CVE-2025-3438","title":"MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.17.4 - Unauthenticated Limited Privilege Escalation","description":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.","status":"published","published":"2025-05-02T05:22:34.308Z","modified":"2026-04-08T17:19:12.414Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:39.378527Z"}],"euvd":[{"id":"EUVD-2025-13296","description":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.","status":"published","published":"2025-05-02T05:22:34Z","modified":"2026-04-08T17:19:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:42.318475Z"}],"ghsa":[{"id":"GHSA-f367-gfrg-qv3c","title":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable...","description":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.","status":"published","published":"2025-05-02T06:31:24Z","modified":"2025-05-02T06:31:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:02:05.821687Z"}],"nvd":[{"id":"CVE-2025-3438","description":"The MStore API – Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.","status":"published","published":"2025-05-02T06:15:48.02Z","modified":"2026-06-17T09:19:57.58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}