CVE-2025-4683 is a missing authorization vulnerability (CWE-862) in the MStore API WordPress plugin that enables authenticated users with low-level privileges (Subscriber and above) to create new posts by exploiting the lack of capability checks in the create_blog function. This issue affects all versions up to 4.17.5 and allows unauthorized modification of data, specifically the creation of content without proper authorization. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. No patch or official remediation guidance is currently provided by the vendor.

The vulnerability allows unauthorized data modification by permitting users with Subscriber-level access or higher to create new posts, potentially leading to content integrity issues. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unauthorized content creation. Avoid granting unnecessary privileges to users. Follow updates from the vendor for a forthcoming patch or official mitigation instructions.