The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
References
Configurations
History
06 May 2025, 15:35
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Inspireui mstore Api
Inspireui |
|
| References | () https://plugins.trac.wordpress.org/changeset/3277790 - Patch | |
| References | () https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L413 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/be5d86ad-f94b-4fcb-9b74-ecddde2bf29d?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset/3279132/ - Patch | |
| References | () https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L392 - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
| CPE | cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:* | |
| CWE | NVD-CWE-noinfo |
02 May 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-02 06:15
Updated : 2025-05-06 15:35
NVD link : CVE-2025-3438
Mitre link : CVE-2025-3438
JSON object : View
Products Affected
inspireui
- mstore_api
CWE