MStore API WordPress Plugin Privilege Escalation Vulnerability

A limited privilege escalation vulnerability has been identified in the MStore API WordPress plugin, specifically in versions through 4.17.4. The issue arises from inadequate role restrictions during the registration process, allowing unauthenticated users to register as 'wcfm_vendor' roles. This vulnerability is exploitable only if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is active.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain vendor roles, potentially leading to unauthorized access or actions within the marketplace.

Reproduction

To reproduce this vulnerability, send a POST request to the '/register' endpoint of the MStore API plugin. Include a 'role' parameter set to 'wcfm_vendor'. This request can be made without authentication, taking advantage of the lack of role validation in versions prior to 4.17.4.

Remediation

Users are advised to update the MStore API WordPress plugin to version 4.17.5 or later.