EUVD-2026-54385
GHSA-w2g6-85hw-mgcv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and PR:N confirmed by REST API attack surface and pre-authentication nature; AC:H reflects the concrete prerequisite of knowing a target's registered phone number; full C/I/A capture complete account takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
AnalysisAI
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The MStore API plugin must be installed and active on the target WordPress site, and the phone-number-based login feature must be in use - sites relying solely on password or OAuth authentication are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 High score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects a network-exploitable, pre-authentication flaw with full impact triad - but the AC:H metric is the critical limiting factor, encoding the requirement to know a registered user's phone number before exploitation is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a specific WordPress administrator identifies their registered phone number from a public profile, leaked dataset, or prior reconnaissance. Using the publicly available POC, the attacker crafts a forged phone-login token for that phone number and submits it to the MStore API REST endpoint, successfully bypassing authentication. … |
| Remediation | Update MStore API to version 4.21.0 or later, which introduces correct cryptographic signature verification for phone-based login tokens; this is the only confirmed fix per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using MStore API plugin and assess versions currently deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mstore Api
View allThe MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to uplo
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to cre
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce
The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today