The MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin suffers from improper access control (CWE-284) due to missing checks on the user registration setting before account creation. This allows unauthenticated attackers to register new user accounts regardless of the site's user registration configuration. The vulnerability is present in all versions up to 4.15.3 and has a CVSS 3.1 base score of 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker can create unauthorized user accounts on affected WordPress sites even when user registration is disabled. This could lead to unauthorized access, potential privilege escalation depending on default roles assigned, and disruption of site operations. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should monitor plugin updates from inspireui and consider disabling or removing the MStore API plugin if user registration control is critical. No official fix or temporary workaround is currently documented.