The MStore API plugin allows an attacker to create a user with the wcfm_vendor role without authentication. This role grants vendor‑level access in the WCFM Marketplace plugin, enabling the attacker to perform vendor‑specific actions. The flaw is a lack of role restriction during registration, which results in a moderate‑severity privilege escalation vulnerability (CWE-269).

WordPress sites running the MStore API – Create Native Android & iOS Apps On The Cloud plugin version 4.17.4 or earlier are affected, but only when the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is also installed and activated. The vulnerability is specific to the InspireUI MStore API product.

The CVSS score of 6.5 indicates a moderate risk. The very low EPSS score (<1%) suggests limited current exploitation activity, and the vulnerability is not listed in CISA KEV. Exploitation requires an unauthenticated attacker who can submit a registration request to the vulnerable plugin on a site that also hosts the WCFM Marketplace plugin. Once achieved, the attacker gains vendor‑level privileges, potentially allowing further manipulation within the plugin ecosystem.