CVE-2025-3438: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfmvendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3438?
CVE-2025-3438 is classified as a limited privilege escalation vulnerability.
How do I fix CVE-2025-3438?
To fix CVE-2025-3438, update the MStore API plugin to version 4.17.5 or later.
Who is affected by CVE-2025-3438?
All users of the MStore API plugin for WordPress using versions up to and including 4.17.4 are affected by CVE-2025-3438.
What causes the vulnerability CVE-2025-3438?
CVE-2025-3438 is caused by a lack of restriction of user roles when registering within the MStore API.
Can unauthenticated users exploit CVE-2025-3438?
Yes, unauthenticated users can exploit CVE-2025-3438 due to the privilege escalation vulnerability.