The MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin suffers from improper privilege management (CWE-269), allowing unauthenticated users to register with the 'wcfm_vendor' role, which is a vendor role in the WCFM Marketplace plugin. This occurs because the plugin does not properly restrict role assignment during registration. The vulnerability affects all versions up to 4.17.4 and requires the WCFM Marketplace plugin to be installed and activated. A partial fix was introduced in version 4.17.3. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An unauthenticated attacker can register as a store vendor in the WCFM Marketplace plugin, potentially gaining elevated privileges within the WordPress site related to vendor capabilities. This could lead to unauthorized actions permitted to vendor roles, impacting confidentiality and integrity of the affected system. Availability is not impacted. Exploitation depends on the presence and activation of the WCFM Marketplace plugin.

A partial patch was introduced in version 4.17.3 of the MStore API plugin. Users should upgrade to the latest version beyond 4.17.4 if available to ensure full remediation. Since no official patch link is provided and the vulnerability is only partially fixed in 4.17.3, users must consult the vendor's advisory or update channels for the latest fixes. If upgrading is not immediately possible, consider disabling the MStore API plugin or the WCFM Marketplace plugin to prevent exploitation. Monitor vendor communications for official fixes.