CVE-2025-4683: Inspireui Mstore Api Auth Bypass Vulnerability

CVE-2025-4683 Overview

The MStore API plugin for WordPress contains a missing authorization vulnerability in the create_blog function. The plugin, used to create native Android and iOS apps on the cloud, exposes the function without a proper capability check. All versions up to and including 4.17.5 are affected. Authenticated attackers with Subscriber-level access or higher can invoke the function to create new posts on the target site. The issue is tracked under CWE-862: Missing Authorization and was assigned CVE-2025-4683 by Wordfence.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can create arbitrary blog posts through the plugin's REST API endpoint.

Affected Products

Inspireui MStore API plugin for WordPress, all versions through 4.17.5
WordPress sites running the plugin with open user registration
Mobile app backends built on the MStore API framework

Discovery Timeline

2025-05-27 - CVE-2025-4683 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4683

Vulnerability Analysis

The MStore API plugin exposes a REST endpoint backed by the create_blog function defined in controllers/helpers/blog-helper.php. The function accepts input from authenticated REST callers and creates a WordPress post entry. Because the function omits a current_user_can() capability check, WordPress treats any authenticated request as authorized to publish content.

Subscriber accounts in WordPress are normally restricted to reading content and managing their profile. This vulnerability elevates their effective privileges by allowing them to publish posts, an action typically reserved for Author, Editor, or Administrator roles. Attackers can abuse this behavior to plant spam, phishing lures, or search engine optimization (SEO) poisoning content on the site.

Exploitation requires only a valid Subscriber account. On WordPress installations where user registration is enabled, attackers can register their own account and immediately abuse the endpoint. The vulnerability does not require user interaction and is exploitable over the network.

Root Cause

The root cause is the absence of an authorization check inside the create_blog handler. The plugin registers the REST route with a permission_callback that verifies authentication but not capability. The handler proceeds to call wp_insert_post() on behalf of the request without validating whether the caller holds the publish_posts or edit_posts capability. See the vulnerable code at blog-helper.php line 24 and line 46.

Attack Vector

The attack vector is a network request to the WordPress REST API endpoint registered by MStore API. An attacker authenticates as a Subscriber, obtains a nonce or application password, and submits a crafted POST request to the create_blog route with title, content, and metadata fields. The plugin creates the post under the attacker's user ID or a specified author, depending on how the handler parses request parameters. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-4683

Indicators of Compromise

New WordPress posts authored by low-privilege user accounts (Subscriber role) that would normally lack publishing rights.
REST API access log entries targeting MStore API routes such as /wp-json/api/flutter_user/create_blog from unexpected IP addresses.
Unexplained increase in wp_posts table entries with recent post_date values not tied to editorial workflows.

Detection Strategies

Query the WordPress database for posts where the author role is Subscriber: audit wp_posts joined against wp_usermeta for wp_capabilities values below Author.
Monitor web server access logs for POST requests to MStore API endpoints originating from newly registered accounts.
Correlate new user registrations with subsequent REST API calls to identify automated abuse patterns.

Monitoring Recommendations

Enable WordPress audit logging plugins that record post creation events with source IP and user agent metadata.
Alert on any post creation performed via REST API by users whose role is Subscriber or Contributor.
Track the MStore API plugin version across managed WordPress fleets to identify installations still on 4.17.5 or earlier.

How to Mitigate CVE-2025-4683

Immediate Actions Required

Update the MStore API plugin to a version later than 4.17.5 that includes the fix from WordPress Change Set #3293669.
Disable open user registration on WordPress sites that do not require it, reducing the pool of accounts that can exploit the endpoint.
Review recent posts and remove content created by unauthorized Subscriber accounts.

Patch Information

The vendor addressed the vulnerability in WordPress Change Set #3293669 by adding a capability check to the create_blog handler. Administrators should upgrade to the patched release available through the WordPress plugin repository. Verify the installed version in the WordPress admin dashboard under Plugins after upgrading.

Workarounds

Deploy a web application firewall (WAF) rule that blocks REST API POST requests to the MStore API create_blog route from users without editor-level capabilities.
Temporarily deactivate the MStore API plugin if the associated mobile app functionality is not in active use.
Restrict the default WordPress registration role or require administrator approval for new accounts to limit exposure.

bash

# Example: disable open registration in wp-config.php or via the admin UI
# In WordPress admin: Settings > General > uncheck "Anyone can register"
wp option update users_can_register 0
wp option update default_role subscriber