MStore API EUVD-2026-54385

The MStore API plugin must be installed and active on the target WordPress site, and the phone-number-based login feature must be in use - sites relying solely on password or OAuth authentication are not affected. The primary limiting condition is that the attacker must know a valid phone number registered to an account on the target site; this is the prerequisite encoded in CVSS AC:H and represents the principal real-world barrier to mass exploitation. No authentication, user interaction, or special attacker infrastructure is required beyond this reconnaissance step. The vulnerability does not affect default WordPress installations without MStore API, and the attack surface is bounded to sites where mobile app authentication via this plugin has been deployed.

The CVSS 8.1 High score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects a network-exploitable, pre-authentication flaw with full impact triad - but the AC:H metric is the critical limiting factor, encoding the requirement to know a registered user's phone number before exploitation is possible. EPSS at 0.14% (3rd percentile) is notably low for a High-severity flaw with a public POC, corroborating that this prerequisite is suppressing opportunistic mass-scanning activity. The publicly available POC (sourced from WPScan) meaningfully raises risk above a theoretical advisory - targeted attacks against known users or sites with exposed phone numbers are plausible. The absence of a CISA KEV listing means active exploitation is not confirmed; the low EPSS is consistent with targeted rather than widespread exploitation. For sites running MStore API with phone-login enabled, the realistic risk is elevated by the POC, especially if phone numbers are discoverable from public user profiles or prior data breaches. No conflicting signals between CVSS and description - both consistently indicate remote, pre-auth, targeted exploitation.

An attacker targeting a specific WordPress administrator identifies their registered phone number from a public profile, leaked dataset, or prior reconnaissance. Using the publicly available POC, the attacker crafts a forged phone-login token for that phone number and submits it to the MStore API REST endpoint, successfully bypassing authentication. With administrator-level access obtained, the attacker installs a malicious plugin, harvests credentials, or establishes persistent backdoor access to the WordPress site.