CVE-2025-3438: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation
First published: Fri May 02 2025(Updated: )
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MStore API | <=4.17.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/be5d86ad-f94b-4fcb-9b74-ecddde2bf29d?source=cve
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L392
- https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L413
- https://plugins.trac.wordpress.org/changeset/3277790
- https://plugins.trac.wordpress.org/changeset/3279132/
Frequently Asked Questions
What is the severity of CVE-2025-3438?
CVE-2025-3438 is classified as a limited privilege escalation vulnerability.
How do I fix CVE-2025-3438?
To fix CVE-2025-3438, update the MStore API plugin to version 4.17.5 or later.
Who is affected by CVE-2025-3438?
All users of the MStore API plugin for WordPress using versions up to and including 4.17.4 are affected by CVE-2025-3438.
What causes the vulnerability CVE-2025-3438?
CVE-2025-3438 is caused by a lack of restriction of user roles when registering within the MStore API.
Can unauthenticated users exploit CVE-2025-3438?
Yes, unauthenticated users can exploit CVE-2025-3438 due to the privilege escalation vulnerability.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/mstore
- canonical/mstore api