CVE-2025-3438

216.73.216.242

· Published 02/05/2025 06:15 · Modified 02/05/2025 13:52

Labels: CVE-2025-3438 2025-05-02 CVE-2025-3438 CWE-269 [email protected]

Essential information

Published: 02/05/2025 06:15
Modified: 02/05/2025 13:52
Author: —
Creator: —
CVSS: 6.5 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS metrics

Description

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
mstore / mstore api	`cpe:2.3:a:mstore:mstore_api:<4.17.5:::::::*`
wcfm / wcfm marketplace	`cpe:2.3:a:wcfm:wcfm_marketplace::::::wordpress::*`